I'm trying to recover a file that has been overwritten with an empty one on a WD MyBook, an Ethernet disk (1 TB) using linux (very stripped down) and XFS partitions. The processor is ARM of course and I don't have any development tools in the WD MyBook. I have SSH access. Any tool or feature introduced after February 2012 (the date of the latest firmware update) won't be available.
The disk needs to be used soon, so the quickest way to attempt the recovery is to dump all the free space (about 300 GB) via network directly to another computer with enough space. The dump to another machine can be done with something like:
(a tool to dump the free space only) | gzip -1 - | ssh user@hostname dd of=image.gz
However I don't know how to dump only the free space of a XFS partition and not the whole disk (1 TB is impossible given the network connection used).
How to do that?