xfs_recovery

1. Overview

The xfs_recovery.cpp file coordinates XFS metadata discovery, directory traversal and file export.

This is an implementation file. It contains executable logic for the subsystem, including parsing, I/O, validation, recovery flow, or graphical behavior declared by the corresponding interface.

Its paired source or interface file is xfs_recovery.hpp.

Primary responsibilities:

  • Read and validate the superblock
  • Locate allocation groups and inode records
  • Traverse XFS directories
  • Resolve extents
  • Export recovered files

2. File Identity and Scope

  • Source path: src/xfs_recovery.cpp
  • Language: C++
  • File role: implementation file
  • Physical lines: 970
  • Non-empty lines: 885
  • SHA-256: f4309c2d2d5cb4886b0217f3d895aab94740f07a9202474c60ed6089481390b2

The declarations in this file use the global namespace.

3. Dependencies

3.1 Project Headers

  • xfs_recovery.hpp
  • xfs_format.hpp
  • xfs_btree.hpp
  • xfs_inode.hpp
  • xfs_dir.hpp
  • i18n.hpp
  • text_utils.hpp

3.2 Standard and External Headers

  • algorithm
  • array
  • cstdint
  • cstring
  • filesystem
  • fstream
  • functional
  • set
  • sstream
  • string
  • vector

These dependencies define the file’s compile-time integration with the recovery engine, GTK interface, on-disk format decoders, operating-system services, or C++ standard library.

4. Declared Types

No class, structure, or enumeration definition is declared directly in this file.

5. Constants and Configuration Values

  • constexpr uint64_t XFS_DIR2_LEAF_OFFSET_BLOCKS=32ull*1024ull*1024ull*1024ull / 4096ull
  • constexpr uint32_t MAX_AG_TO_PROBE=4096
  • constexpr int MAX_DEPTH=64

5.1 Operational Strings, Paths, Formats, or Commands

The following code literals are operationally relevant and may identify filesystem paths, helper commands, formats, signatures, or subsystem labels:

  • xfs_recovery.hpp
  • xfs_format.hpp
  • xfs_btree.hpp
  • xfs_inode.hpp
  • xfs_dir.hpp
  • XFS dir: read failed at FSB
  • XFS dir: no recognised data block magic in extent list
  • XFS recovery (session 4: full dir/file extraction) starting at offset
  • XFS: cannot read superblock
  • XFS: not a valid superblock at this offset
  • XFS: geometry inconsistent:
  • XFS volume identified: V
  • XFS V5 features:
  • XFS AG headers loaded: AGF
  • /
  • XFS: no AG headers could be parsed; volume looks corrupt or
  • this is a partition without an XFS volume at offset 0
  • xfs
  • XFS: max recursion depth reached, stopping branch.
  • XFS: file export safety cap reached (
  • XFS: failed to read dinode for ino
  • XFS: bad dinode magic at ino
  • XFS: cannot parse shortform dir at ino
  • XFS: dir ino
  • XFS: directory ino
  • XFS: cannot read child dinode for '
  • XFS: bad child dinode magic for '
  • XFS: cannot mkdir
  • XFS: cannot read extents for '
  • XFS
  • XFS: failed to export '
  • XFS: cannot create file
  • XFS: cannot read symlink extents for '
  • XFS: cannot read symlink body for '
  • XFS: superblock has no root inode (rootino=0).
  • XFS FINOBT: candidate cap reached (200k slots)
  • XFS FINOBT:
  • XFS FINOBT: deleted-file recovery -- attempted
  • XFS FINOBT: no deleted files recovered.
  • XFS recovery completed.

6. Data Members and Persistent State

No class data members are declared directly in this file, or the file primarily implements methods declared elsewhere.

7. API and Function Inventory

The following callable interfaces or definitions were detected:

  • bool read_exact(DiskReader&reader,uint64_t off,void*dst,size_t n) – Reads or derives the requested information and returns or stores the decoded result.
  • bool validate_geometry(DiskReader&reader,uint64_t volume_offset,const xfs::Superblock&sb,std::string&err) – Evaluates the stated condition and returns the corresponding Boolean result.
  • void load_ag_headers(DiskReader&reader,uint64_t volume_offset,const xfs::Superblock&sb,uint32_t agno,xfs::AGContext&ag,std::vector<std::string>&logs) – Reads or derives the requested information and returns or stores the decoded result.
  • bool read_dinode(DiskReader&reader,const xfs::VolumeContext&vol,uint64_t ino,std::vector<unsigned char>&buf) – Reads or derives the requested information and returns or stores the decoded result.
  • bool write_extents_to_path(DiskReader&reader,const xfs::VolumeContext&vol,std::vector<xfs::Extent> extents,uint64_t file_size,const fs::path&out_path,std::string&err) – Persists or exports the supplied state to the relevant destination.
  • bool collect_extents(DiskReader&reader,const xfs::VolumeContext&vol,const xfs::DinodeCore&core,const unsigned char*fork_data,uint32_t fork_len,uint32_t max_extents,std::vector<xfs::Extent>&out,std::vector<std::string>&logs,std::string&err) – Implements the operation identified by this API and updates or returns the associated state.
  • bool read_extents_data(DiskReader&reader,const xfs::VolumeContext&vol,const std::vector<xfs::Extent>&extents,uint64_t file_size,std::vector<unsigned char>&out,std::string&err) – Reads or derives the requested information and returns or stores the decoded result.
  • bool collect_dir_entries_block_or_leaf(DiskReader&reader,const xfs::VolumeContext&vol,const std::vector<xfs::Extent>&extents,bool has_ftype,std::vector<xfs::DirEntry>&out,std::vector<std::string>&logs) – Implements the operation identified by this API and updates or returns the associated state.
  • XfsRecovery::XfsRecovery(DiskReader&reader): reader_(reader) – Implements the operation identified by this API and updates or returns the associated state.
  • bool XfsRecovery::recover(uint64_t volume_offset,const std::string&output_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error) – Performs the associated recovery or extraction operation.

8. Operational Flow

The subsystem represented by this file normally participates in the following flow:

  1. Read and validate the superblock.
  2. Locate allocation groups and inode records.
  3. Traverse XFS directories.
  4. Resolve extents.
  5. Export recovered files.
  6. Expose or execute the detected APIs: read_exact, validate_geometry, load_ag_headers, read_dinode, write_extents_to_path, collect_extents, read_extents_data, collect_dir_entries_block_or_leaf, XfsRecovery, recover.
  7. Return explicit results, progress data, recovered records, or diagnostics to the calling layer.

9. Validation and Error Handling

  • Errors are propagated through Boolean results, error strings, logs, exceptions, or status records depending on the API.
  • Byte offsets, sizes and lengths must be validated before arithmetic and before every read to avoid overflow and out-of-bounds access.
  • On-disk structures are accepted only after validating signatures, magic values and structural constraints.
  • Input and output paths require existence checks, permission handling and safe destination construction.
  • The implementation contains explicit failure-catching paths and should retain the original diagnostic context.

10. Runtime, Concurrency, and Resource Management

  • I/O: filesystem and raw-source operations can fail partially and must preserve exact byte counts and diagnostic context.
  • Error handling: explicit error, exception or optional-result paths are present and form part of the file contract.
  • File descriptors and streams must be closed on success, cancellation and error paths.

11. Security and Data-Recovery Considerations

  • Recovery code should prefer read-only source access and avoid writing to the original damaged medium.
  • Raw devices and image files are treated as untrusted binary input; every offset and length must remain bounded by the source size.
  • Recovered names and destination paths must be sanitized to prevent directory traversal and accidental overwrite outside the selected export directory.

12. Implementation Considerations

  • The implementation should remain aligned with declarations in the paired header and preserve documented return-value semantics.
  • Binary decoding uses low-level memory operations or casts; alignment, endianness and packed-structure assumptions require careful review.
  • Large-device arithmetic uses 64-bit values; additions and multiplications should be checked before use as offsets or allocation sizes.
  • Filesystem operations can cross trust boundaries and should use normalized, contained destination paths.

13. Integration with the Recovery Pipeline

  • The file belongs to the extraction layer and consumes scan candidates or validated filesystem metadata.
  • Recovered output is represented through shared models and returned to the exporter or UI.
  • Partial recovery must be reported explicitly rather than silently treated as complete.

14. Licensing and Provenance

No explicit copyright or software-license statement was detected in the opening section of this individual file. Distribution terms should therefore be verified against the project-level license and repository metadata.

The SHA-256 value in this document can be used to associate the generated documentation with the exact source version analyzed.

Published on:
Last updated on: