Altirium logo

UNIX Hard Drive Data Recovery

About UNIX File Systems

Since the 1970s UNIX has been a popular operating system in mid-range computing and for high intensity applications such as graphics and video processing. Although some of the ground traditionally occupied by UNIX has been taken by the emergence of Windows and the increase in power of desktop systems, UNIX has retained a lot of its popularity, and this has been re-inforced by the rise of LINUX

UNIX file systems typically follow similar methodologies for storing data, partly as new file systems largely evolve from older ones and to an extent because the original file systems had a good solid balance of performance and reliability

UFS is the archetypal UNIX file system, although not the first UNIX file system it is the one from which many others developed and understanding UFS is a good basis for understanding EXT3, XFS and several other UNIX file systems. The key principal of the "typical" UNIX file system is the allocation group (aka cylinder group or block group). To balance the load of I/O across the disk the file system is divided into a number of equally sized sections across which the data from files is distributed. Each allocation group contains, or may contain, copies of the key file system information (in the case of UFS this is the superblock), and each contains a set of inode entries. A UNIX inode is the structure that is at the root of any file, it stores information pertaining to a file's time, date, permissions, size and space allocation.

Each file is represented by one inode. Since a fixed sized inode entry can only hold a finite amount of information about the space occupied by a file a method of indirect allocation is employed. For the first few entries within the inode the allocation pointers reference data directly, these are known as direct addresses. Thereafter the addresses are for blocks of data that are themselves comprised of addresses for either data, or further address blocks. The the first indirect address in the inode in a file system with a block size of 16384, points to a block that contain address for up to 4,096 blocks of data. The second indirect address points to a block containing up to 4,096 addresses each of which is for a block containing addresses for up to 4,096 blocks of data. So, as a file expands the overhead in working out where the data is does increase a bit but the only restriction is the number of levels of indirection allowed.

There is move to using extents rather than single block addresses, so for example rather than having an entry that says there is data at block 4, then another saying there is data in block 5 and so on, one entry can be for there being data in block 4 for 15 blocks. This only works if the allocation is contiguous, which much of is is in this type of file system, and it saves a lot of time in storing addresses.

UNIX Hard Drive Data Recovery

Hard drive error or failure is probably the most common cause we see of problems resulting in the need for UNIX data recovery. If the problem is purely mechanical and all of the data can be recovered from the disk drive then there are no considerations with regard to the file system, the data can be transferred to a new disk and the problem is solved. When there are areas of data loss, as will be the case when there is physical damage to the hard drive platter, or head failure has caused areas of the disk to become unreadable, then the structure of the file system becomes critical. Systems such as UFS, XFS, JFS and EXT3 store backup copies of superblocks and some other structures that can, in part, be used to compensate for some data loss that causes purely file system related problems. In basic terms, UFS data recovery is much the same as EXT3 data recovery or XFS data recovery, though there is quite a lot of detail to find the devil in.

File deletion has long cause problems as there are few utilities available, if any, that can do any form of undeletion on most UNIX systems. The biggest problem is when an inode has been reused following a deletion, as then the allocation information has been lost. Whilst this tends to render a generalised file system recovery as impracticable, Altirium have had a great deal of success with the recovery of specific files by using other file system information to map out the allocation.

More complex file systems such as ZFS have the potential to present far greater issues. ZFS is less of a file system and more of a filing environment that can be spread across multiple disparate forms of data storage, so within a ZFA file system data can span RAID systems, data files and single disks. This does not mean that a ZFS data recovery is not possible, but it does make it more "interesting".

Last Updated (Tuesday, 09 June 2009 15:50)

QMD 9001 logo
ISO9001:2008 Certified