Recover Accidentally Deleted XFS Files in Minutes with xfs_undelete

Why xfs_undelete is the preferred XFS recovery tool

XFS stores inode metadata differently from ext4, so generic undelete utilities cannot reliably recover deleted files. xfs_undelete is an open‑source Tcl script written specifically for XFS and provides four key advantages:

Read‑only operation – The program only reads raw disk data and never writes to the target partition, eliminating the risk of further damage.

Built‑in file‑type detection – An internal engine discards fragments that do not match known MIME types, preventing a flood of garbage files.

Multi‑dimensional filtering – Users can limit the scan by deletion time, file type, and size to locate the exact files they need.

Zero‑compilation onboarding – The script is executable after a simple chmod +x; no build chain is required.

Rapid 5‑minute deployment

Prerequisites (CentOS 7 example)

# Install Tcl interpreter and required libraries
yum install -y tcl tcllib coreutils file

tcl – Tcl runtime.

tcllib – Additional Tcl functions.

coreutils – Standard GNU utilities.

file – MIME‑type identification tool.

Download the tool

Place the tool on a non‑target disk to avoid overwriting the source data.

# Create a temporary directory for the tool
mkdir -p /tmp/tools && cd /tmp/tools
# Clone the source repository (mirrored)
git clone https://gitcode.com/gh_mirrors/xf/xfs_undelete
cd xfs_undelete
chmod +x xfs_undelete
# Original upstream repository
# https://github.com/ianka/xfs_undelete

The script is pure Tcl; after granting execute permission it can be run directly.

Core commands – from basic to advanced

Pre‑condition : Stop all writes to the target partition. Unmount it before running any recovery command.

# Unmount the target partition (example /dev/sda4)
umount /dev/sda4

Basic recovery – all deletable files

# Recover every deleted file from /dev/sda4
./xfs_undelete /dev/sda4

By default recovered files are written to a folder named xfs_undeleted in the current working directory.

Advanced 1 – time‑based filtering

# Files deleted in the last 48 hours
./xfs_undelete -t 48h /dev/sda4
# Files deleted after 2026‑01‑16
./xfs_undelete -t "2026-01-16.." /dev/sda4
# Files deleted between 2026‑01‑16 and 2026‑01‑17
./xfs_undelete -t "2026-01-16..2026-01-17" /dev/sda4

Advanced 2 – file‑type filtering

# Recover only image files (jpg, png, gif, …)
./xfs_undelete -r "image/*" /dev/sda4
# Recover only document files (txt, pdf, docx)
./xfs_undelete -r "text/plain,application/pdf,application/vnd.openxmlformats-officedocument.wordprocessingml.document" /dev/sda3

Advanced 3 – custom output directory

Direct the recovered files to a separate mount point to keep the target disk untouched.

# Create a dedicated recovery directory on another disk
mkdir -p /mnt/recovery
# Save recovered files to /mnt/recovery
./xfs_undelete -o /mnt/recovery /dev/sda4

Real‑world scenarios

Scenario 1 – accidental deletion of Nginx configuration (<2 hours old)

Stop the Nginx service to prevent new writes: systemctl stop nginx Unmount the partition containing /etc/nginx/conf.d (e.g., /dev/sda4): umount /dev/sda4 Recover recent text files and store them on a safe disk:

./xfs_undelete -t -2h -r "text/plain" -o /mnt/recovery /dev/sda4

Copy the recovered configuration files from /mnt/recovery back to their original location and restart Nginx.

Scenario 2 – front‑end team deletes a batch of PNG images

Unmount the partition holding the design assets (e.g., /dev/sdb1): umount /dev/sdb1 Recover all images deleted in the past 24 hours and write them to an external disk:

./xfs_undelete -t -24h -r "image/*" -o /mnt/design_recovery /dev/sdb1

Scenario 3 – system binaries (e.g., /usr/bin/ls ) removed, recovery in single‑user mode

Reboot and edit the GRUB entry, appending init=/bin/bash to boot into a root shell.

Remount the root filesystem read‑only to avoid further damage: mount -o remount,ro / Mount an external USB drive for safe output (e.g., /dev/sdc1) : mount /dev/sdc1 /mnt/usb Recover executable files and store them on the USB drive:

./xfs_undelete -r "application/x-executable" -o /mnt/usb/recovery /dev/sda1

Copy the recovered binaries back to /usr/bin and reboot the system.

Advanced tips & common pitfalls for operators

Act quickly – Deleted data remains until overwritten. Stop all writes and begin recovery immediately.

Run as root – Access to raw block devices requires root privileges.

Never use the target partition for output – Writing recovered files to the same disk can overwrite the data you are trying to restore.

Common issues and troubleshooting

Permission denied : Execute the command with sudo or as the root user.

Recovered files are garbled : The underlying blocks were likely overwritten or the -r filter was incorrect; adjust the filter and retry.

No deleted inodes found : Either the partition contains no recoverable deletions or it is not an XFS filesystem.

Conclusion

xfs_undelete

acts as a “regret‑pill” for XFS, enabling rapid recovery of accidentally deleted files when used correctly. Nevertheless, proactive backups and disciplined change management remain the most reliable defense against data loss.