xfsfsr

xfsfsr is a software utility focused on analysis and recovery for XFS file systems. It operates on disk images or unmounted devices and provides a read-only examination of on-disk structures and metadata without modifying the source data.

The project aims to aid digital forensics, incident response, and data recovery by extracting filesystem metadata, mapping files to inodes and allocation groups, and reconstructing file system state from damaged areas.

Core features include metadata extraction from XFS structures such as allocation groups, inodes, B-trees, and the log; support for forensic artifacts such as deleted file fragments; integrity verification; and the generation of human-readable and machine-readable reports. It supports export to JSON and CSV and can output timelines of file activity.

Architecture and usage: implemented in C with bindings to Python for scripting; runs on Linux and BSD with minimal dependencies; can process raw device paths or disk images; operates in read-only mode by default; includes a modular plugin interface.

Limitations include reliance on intact on-disk metadata; severe corruption may impede recovery; xfsfsr is not a complete replacement for dedicated filesystem repair tools.

Development status: xfsfsr is an independent, community-driven project with ongoing development and evolving documentation. See also XFS filesystem and forensic analysis tools for related topics.