how to recover data from formatted btrfs partition

how to recover data from formatted btrfs partition

[Konstantin V. Gavrilenko]

Hi list,

I accidentally formatted the existing btrfs partition today with mkfs.btrfs
Partition obviously table remained intact, while all three superblock 0,1,2 correspond to the new btrfs UUID.
The original partition was daily snapshotted and was mounted using "compress-force=lzo,space_cache=v2" so I guess the recovery using photorec would be troublesome.

Is there any chance to recover the data?
Any ideas or advices would be highly appreciated.


yours,
Kos

Re: how to recover data from formatted btrfs partition

[Chris Murphy]

On Sun, Jul 28, 2019 at 10:36 AM Konstantin V. Gavrilenko
<k.gavrilenko@arhont.com> wrote:
>
> Hi list,
>
> I accidentally formatted the existing btrfs partition today with mkfs.btrfs
> Partition obviously table remained intact, while all three superblock 0,1,2 correspond to the new btrfs UUID.
> The original partition was daily snapshotted and was mounted using "compress-force=lzo,space_cache=v2" so I guess the recovery using photorec would be troublesome.
>
> Is there any chance to recover the data?
> Any ideas or advices would be highly appreciated.

mkfs.btrfs doesn't write that much data, but does zero some other
things out to avoid later confusion so it's plausible some of the
previous btrfs has already been damaged by those overwrites. But if
you ignore that, I bet you can reconstruct the old super and at least
do a read only mount of the previous file system, and at least get a
backup.

The hard part is finding the start LBA for all the roots, and the
physical address for the system chunk so that you can populate the
system chunk array field in the super block correctly. It's mainly a
question of time and effort, there's no tool that can do this for you,
it's pretty much a manual process.


-- 
Chris Murphy

Re: how to recover data from formatted btrfs partition

[Konstantin V. Gavrilenko]

>>On Sun, Jul 28, 2019 at 10:36 AM Konstantin V. Gavrilenko
>><k.gavrilenko@xxxxxxxxxx> wrote:
>>
>> Hi list,
>>
>> I accidentally formatted the existing btrfs partition today with mkfs.btrfs
>> Partition obviously table remained intact, while all three superblock 0,1,2 correspond to the new btrfs UUID.
>> The original partition was daily snapshotted and was mounted using "compress-force=lzo,space_cache=v2" so I guess the recovery using >photorec would be troublesome.
>>
>> Is there any chance to recover the data?
>> Any ideas or advices would be highly appreciated.
>
>mkfs.btrfs doesn't write that much data, but does zero some other
>things out to avoid later confusion so it's plausible some of the
>previous btrfs has already been damaged by those overwrites. But if
>you ignore that, I bet you can reconstruct the old super and at least
>do a read only mount of the previous file system, and at least get a
>backup.
>
>The hard part is finding the start LBA for all the roots, and the
>physical address for the system chunk so that you can populate the
>system chunk array field in the super block correctly. It's mainly a
>question of time and effort, there's no tool that can do this for you,
>it's pretty much a manual process.
>
>
>-- 
>Chris Murphy


Thanks Chris,

frankly my knowledge of BTRFS internals is not that great, so I wonder if you can point me to the right direction.

From my understanding the system chunk items stored in the superblock at the default physical address 0x10000 and 2 others would have the address of the new system chunk that was created after the partition was reformatted. So how can I find the physical address for the old system chunk?


regards,
Konstantin




----- Original Message -----
From: "Konstantin V. Gavrilenko" <k.gavrilenko@arhont.com>
To: linux-btrfs@vger.kernel.org
Sent: Sunday, 28 July, 2019 6:28:06 PM
Subject: how to recover data from formatted btrfs partition

Hi list,

I accidentally formatted the existing btrfs partition today with mkfs.btrfs
Partition obviously table remained intact, while all three superblock 0,1,2 correspond to the new btrfs UUID.
The original partition was daily snapshotted and was mounted using "compress-force=lzo,space_cache=v2" so I guess the recovery using photorec would be troublesome.

Is there any chance to recover the data?
Any ideas or advices would be highly appreciated.


yours,
Kos

Re: how to recover data from formatted btrfs partition

[Konstantin V. Gavrilenko]

Update to the story. In case anyone ends up in a similar situation as myself.

I managed to successfully restore all the files using UFS Explorer Standard edition. The app has analysed the disk structure found several BTRFS UUID, reconstructed the needed trees and restored the missing data. Can highly recommend it.

Regards,
Konstantin


----- Original Message -----
From: "Konstantin V. Gavrilenko" <k.gavrilenko@arhont.com>
To: linux-btrfs@vger.kernel.org
Sent: Sunday, 28 July, 2019 6:28:06 PM
Subject: how to recover data from formatted btrfs partition

Hi list,

I accidentally formatted the existing btrfs partition today with mkfs.btrfs
Partition obviously table remained intact, while all three superblock 0,1,2 correspond to the new btrfs UUID.
The original partition was daily snapshotted and was mounted using "compress-force=lzo,space_cache=v2" so I guess the recovery using photorec would be troublesome.

Is there any chance to recover the data?
Any ideas or advices would be highly appreciated.


yours,
Kos