Recovery of Deleted Data and Associated Metadata from XFS and Btrfs Filesystems

Abstract

Data recovery from modern file systems has become one of the critical challenges related to digital forensics, data security, and disaster management. When operating systems 'delete' files, they do not remove the actual data from storage; they remove metadata references, and thus, the underlying blocks remain intact until overwritten. Advanced file systems like XFS and Btrfs have made things worse because of features such as journaling, copy-on-write, snapshot, and extent-based allocation. Recovery tools either optimize for older file systems or use raw data carving techniques, which result in incomplete recovery with high false-positive rates. A unique end-to-end recovery framework has been developed that is exclusively tailored according to the recovery requirements of XFS and Btrfs file systems. This automated framework performs file system type detection, a scan of free blocks, the extraction of deleted file content, and recovery of associated metadata, including inodes, timestamps, and extended attributes. As such, the approach integrates file system-aware metadata analysis with constrained carving so that the accuracy and completeness of the recovery are enhanced as compared to existing methods. To ensure the integrity of the recovered data, they are checked by checksums, then categorized according to their file types, and finally presented to the user in structured reports. The proposed framework will extend support to forensic investigations and secure data restoration in enterprise and personal computing environments.