Re: dd does it again!

[Anand Jain <anand.jain@oracle.com>]

On 11/11/19 10:44 AM, Paul Monsour wrote:
> Hi,
> 
> I did it; I used dd and accidentally zapped all of my personal files, which were under the /home directory. This was a btrfs raid0 setup with /dev/sdc1 and /dev/sdd1. I aborted the command after it had started but before it had completed. Neither directory is now mountable, but btrfs fi show produced the following output:
> 
> [root@sysresccd /]# btrfs fi show
> Label: none  uuid: 9819165f-fade-471a-9f93-86f36523e58a
>      Total devices 1 FS bytes used 28.81GiB
>      devid    1 size 48.82GiB used 32.02GiB path /dev/sdb1
> warning, device 2 is missing
> Label: none  uuid: 9985ee11-bc6d-4f06-ab15-3156457ba29c
>      Total devices 1 FS bytes used 32.75GiB
>      devid    1 size 58.59GiB used 45.06GiB path /dev/sdb5
> Label: none  uuid: 073f1926-d84d-4150-9498-4239b5383272
>      Total devices 2 FS bytes used 629.10GiB
>      devid    1 size 2.73TiB used 646.12GiB path /dev/sdc1
>      *** Some devices missing
> 
> parted -l produced:
> 
> Model: ATA ST3000DM008-2DM1 (scsi)
> Disk /dev/sdc: 3001GB
> Sector size (logical/physical): 512B/4096B
> Partition Table: gpt
> Disk Flags:
> Number  Start   End     Size    File system  Name  Flags
>   1      1049kB  3001GB  3001GB  btrfs        Home
> 
> Model: ATA ST3000DM008-2DM1 (scsi)
> Disk /dev/sdd: 3001GB
> Sector size (logical/physical): 512B/4096B
> Partition Table: msdos
> Disk Flags:
> Number  Start  End     Size    Type     File system  Flags
>   2      119kB  1593kB  1475kB  primary               esp
> 
> The portion of the dd command that wrecked the files was "of=/dev/sdd1"

  btrfs keeps 2 or 3 copies of superblock depending on the disk size,
  you could try recover superblock from the backup superblock, but
  first try to read all the superblocks using the command..
    btrfs inspect-internal dump-super -a <dev>
  And if there is any superblock copy which is still not overwritten.
  you can recover using..
    btrfs rescue super-recover [options] <device>

  But depending on the extent of the accidental overwrite on the
  RAID0, there is slim chances to recover the data and metadata.

HTH.

Thanks, Anand


> 
> btrfs restore produced just:
> 
> drwxr-xr-x 1 root root   0 Nov 10 12:43 ftp
> drwxr-xr-x 1 root root 362 Nov 10 12:51 palsor
> 
> However, I was (perhaps optimistically) heartened by what "btrfs-find-root /dev/sdc1" produced:
> 
> # btrfs-find-root /dev/sdc1
> warning, device 2 is missing
> Superblock thinks the generation is 322292
> Superblock thinks the level is 1
> Found tree root at 649710272512 gen 322292 level 1
> 
> How do I use this information? Is there reason to be optimistic?
> 
> Thanks in advance for your help.
> 
> Paul Monsour
> 
> 
> 
>