Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
btrfs-question. Recover data after btrfs.mkfs
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Kernel & Hardware
View previous topic :: View next topic  
Author Message
ratten
n00b
n00b


Joined: 25 Mar 2014
Posts: 6

PostPosted: Sun Jan 08, 2017 1:39 am    Post subject: btrfs-question. Recover data after btrfs.mkfs Reply with quote

Hey People,

I have a Question regarding btrfs.
I had a previously btrfs-formatted partition with data and thought i do not need it anymore so i did a btrfs.mkfs on it.
Well, it turned out that i still need some data from that partition.
Is it possible to still recover the previous data from that partition despite my btrfs.mkfs on the partition?
The partition was not changed in size only a fresh btrfs.mkfs. Also no data was added to the filesystem after the btrfs.mkfs

The command "btrfs-find-root" seems to hang:
# btrfs-find-root -a /dev/sda4
Superblock thinks the generation is 11
Superblock thinks the level is 0

Is it possible to recover data or maybe even the whole datasystemstructure from the previous btrfs-filesystem?
_________________
“If I made one person happy, it's all been worth it” -Tony Clifton
Back to top
View user's profile Send private message
DawgG
l33t
l33t


Joined: 17 Sep 2003
Posts: 724

PostPosted: Mon Jan 09, 2017 10:35 am    Post subject: Reply with quote

if you are very lucky, you might find sth. with btrfs-recover or btrfs-rescue, but i do not think so because your fresh filesystem is not damaged; i.e. the working structures of the old fs have been replaced with working structures of the new (empty) fs.
depending on the size you should create an image with dd or ddrescue and try to recover the data from that that with testdisk/photorec or sth similar. this (probably) works but is no fun because it only recovers the files but not the filenames.
GOOD LUCK!
_________________
DUMM KLICKT GUT.
Back to top
View user's profile Send private message
yilmi
n00b
n00b


Joined: 03 Jan 2017
Posts: 3

PostPosted: Mon Jan 09, 2017 5:58 pm    Post subject: Reply with quote

You can try testdisk, it is used by forensics professionals and it is licensed under GPL ;-)
see http://www.cgsecurity.org/wiki/TestDisk
Back to top
View user's profile Send private message
The_Great_Sephiroth
l33t
l33t


Joined: 03 Oct 2014
Posts: 813
Location: Fayetteville, NC, USA

PostPosted: Tue Jan 10, 2017 4:36 pm    Post subject: Reply with quote

I was also going to recommend testdisk, but if the data structures in BTRFS are re-written then even if the data is still there (I did not see you mention wiping the disk, so chances are the data itself IS there) it may be hard to recognize it.
_________________
Ever picture systemd as what runs "The Borg"?
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 36782
Location: 56N 3W

PostPosted: Tue Jan 10, 2017 6:26 pm    Post subject: Reply with quote

ratten,

The normal way to find your data it a flesystem is to traverse the directory tree starting with the root directory.
The root directory is gone. Making a new filesystem made a new root directory.
It also marked all the space in the filesystem as free. This is all generic filesystem stuff.

If this is on an SSD, all the space will have been discarded at filesystem make time too, so the SSD will be doing block erases in its own time.

Its likely that all the data and subdirectories below the root filesystem are still there.
Depending on what and where btrfs stores metadata, that may or may not be enough to get started picking at file fragments.

How desperate are you to recover files?
Code:
emerge sleuthkit
and poke about. I'm not sure if it supports btrfs. Its a forensics toolkit.
If you can find a subdirectory, you may be able to copy the files out and navigate to other directories.
Its not an easy tool to use, you will likely need to spend a lot of your free time with sleuthkit.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
ratten
n00b
n00b


Joined: 25 Mar 2014
Posts: 6

PostPosted: Wed Jan 11, 2017 8:56 pm    Post subject: Reply with quote

Oki, i understand...root tree is gone...well, i thought maybe btrfs offers an option...
Thanks for the explanation.
I have now recovered with TestDisk(THX @yilmi) what TestDisk could find and trying to make sense of the Files..they are not recovered under their original name so...it's a mess...
Will give sleuthkit a chance too...

Thanks @all for looking into it...
_________________
“If I made one person happy, it's all been worth it” -Tony Clifton
Back to top
View user's profile Send private message
antonakabug
n00b
n00b


Joined: 12 Jan 2017
Posts: 1

PostPosted: Thu Jan 12, 2017 12:24 pm    Post subject: Reply with quote

btrfs-progs version 4.3.1 helped to me.
btrfs-find-root -a not hang
All greater version hanged for me.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Kernel & Hardware All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum