dd does it again!

dd does it again!

[Paul Monsour]

Hi,

I did it; I used dd and accidentally zapped all of my personal files, which were under the /home directory. This was a btrfs raid0 setup with /dev/sdc1 and /dev/sdd1. I aborted the command after it had started but before it had completed. Neither directory is now mountable, but btrfs fi show produced the following output:

[root@sysresccd /]# btrfs fi show
Label: none  uuid: 9819165f-fade-471a-9f93-86f36523e58a
    Total devices 1 FS bytes used 28.81GiB
    devid    1 size 48.82GiB used 32.02GiB path /dev/sdb1
warning, device 2 is missing
Label: none  uuid: 9985ee11-bc6d-4f06-ab15-3156457ba29c
    Total devices 1 FS bytes used 32.75GiB
    devid    1 size 58.59GiB used 45.06GiB path /dev/sdb5
Label: none  uuid: 073f1926-d84d-4150-9498-4239b5383272
    Total devices 2 FS bytes used 629.10GiB
    devid    1 size 2.73TiB used 646.12GiB path /dev/sdc1
    *** Some devices missing

parted -l produced:

Model: ATA ST3000DM008-2DM1 (scsi)
Disk /dev/sdc: 3001GB
Sector size (logical/physical): 512B/4096B
Partition Table: gpt
Disk Flags:
Number  Start   End     Size    File system  Name  Flags
 1      1049kB  3001GB  3001GB  btrfs        Home

Model: ATA ST3000DM008-2DM1 (scsi)
Disk /dev/sdd: 3001GB
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Disk Flags:
Number  Start  End     Size    Type     File system  Flags
 2      119kB  1593kB  1475kB  primary               esp

The portion of the dd command that wrecked the files was "of=/dev/sdd1"

btrfs restore produced just:

drwxr-xr-x 1 root root   0 Nov 10 12:43 ftp
drwxr-xr-x 1 root root 362 Nov 10 12:51 palsor

However, I was (perhaps optimistically) heartened by what "btrfs-find-root /dev/sdc1" produced:

# btrfs-find-root /dev/sdc1
warning, device 2 is missing
Superblock thinks the generation is 322292
Superblock thinks the level is 1
Found tree root at 649710272512 gen 322292 level 1

How do I use this information? Is there reason to be optimistic?

Thanks in advance for your help.

Paul Monsour

Re: dd does it again!

[Anand Jain]

On 11/11/19 10:44 AM, Paul Monsour wrote:
> Hi,
> 
> I did it; I used dd and accidentally zapped all of my personal files, which were under the /home directory. This was a btrfs raid0 setup with /dev/sdc1 and /dev/sdd1. I aborted the command after it had started but before it had completed. Neither directory is now mountable, but btrfs fi show produced the following output:
> 
> [root@sysresccd /]# btrfs fi show
> Label: none  uuid: 9819165f-fade-471a-9f93-86f36523e58a
>      Total devices 1 FS bytes used 28.81GiB
>      devid    1 size 48.82GiB used 32.02GiB path /dev/sdb1
> warning, device 2 is missing
> Label: none  uuid: 9985ee11-bc6d-4f06-ab15-3156457ba29c
>      Total devices 1 FS bytes used 32.75GiB
>      devid    1 size 58.59GiB used 45.06GiB path /dev/sdb5
> Label: none  uuid: 073f1926-d84d-4150-9498-4239b5383272
>      Total devices 2 FS bytes used 629.10GiB
>      devid    1 size 2.73TiB used 646.12GiB path /dev/sdc1
>      *** Some devices missing
> 
> parted -l produced:
> 
> Model: ATA ST3000DM008-2DM1 (scsi)
> Disk /dev/sdc: 3001GB
> Sector size (logical/physical): 512B/4096B
> Partition Table: gpt
> Disk Flags:
> Number  Start   End     Size    File system  Name  Flags
>   1      1049kB  3001GB  3001GB  btrfs        Home
> 
> Model: ATA ST3000DM008-2DM1 (scsi)
> Disk /dev/sdd: 3001GB
> Sector size (logical/physical): 512B/4096B
> Partition Table: msdos
> Disk Flags:
> Number  Start  End     Size    Type     File system  Flags
>   2      119kB  1593kB  1475kB  primary               esp
> 
> The portion of the dd command that wrecked the files was "of=/dev/sdd1"

  btrfs keeps 2 or 3 copies of superblock depending on the disk size,
  you could try recover superblock from the backup superblock, but
  first try to read all the superblocks using the command..
    btrfs inspect-internal dump-super -a <dev>
  And if there is any superblock copy which is still not overwritten.
  you can recover using..
    btrfs rescue super-recover [options] <device>

  But depending on the extent of the accidental overwrite on the
  RAID0, there is slim chances to recover the data and metadata.

HTH.

Thanks, Anand


> 
> btrfs restore produced just:
> 
> drwxr-xr-x 1 root root   0 Nov 10 12:43 ftp
> drwxr-xr-x 1 root root 362 Nov 10 12:51 palsor
> 
> However, I was (perhaps optimistically) heartened by what "btrfs-find-root /dev/sdc1" produced:
> 
> # btrfs-find-root /dev/sdc1
> warning, device 2 is missing
> Superblock thinks the generation is 322292
> Superblock thinks the level is 1
> Found tree root at 649710272512 gen 322292 level 1
> 
> How do I use this information? Is there reason to be optimistic?
> 
> Thanks in advance for your help.
> 
> Paul Monsour
> 
> 
> 
> 

Re: dd does it again!

[Chris Murphy]

On Mon, Nov 11, 2019 at 2:44 AM Paul Monsour <boulos@gmx.com> wrote:
>
> parted -l produced:
>
> Model: ATA ST3000DM008-2DM1 (scsi)
> Disk /dev/sdc: 3001GB
> Sector size (logical/physical): 512B/4096B
> Partition Table: gpt
> Disk Flags:
> Number  Start   End     Size    File system  Name  Flags
>  1      1049kB  3001GB  3001GB  btrfs        Home
>
> Model: ATA ST3000DM008-2DM1 (scsi)
> Disk /dev/sdd: 3001GB
> Sector size (logical/physical): 512B/4096B
> Partition Table: msdos
> Disk Flags:
> Number  Start  End     Size    Type     File system  Flags
>  2      119kB  1593kB  1475kB  primary               esp
>
> The portion of the dd command that wrecked the files was "of=/dev/sdd1"

OK? According to the parted output, there is a single partition number
2, therefore only /dev/sdd2 should exist and the dd command should
have failed. So... something is missing in the information provided,
or maybe a typo somewhere.



>
> btrfs restore produced just:
>
> drwxr-xr-x 1 root root   0 Nov 10 12:43 ftp
> drwxr-xr-x 1 root root 362 Nov 10 12:51 palsor
>
> However, I was (perhaps optimistically) heartened by what "btrfs-find-root /dev/sdc1" produced:
>
> # btrfs-find-root /dev/sdc1
> warning, device 2 is missing
> Superblock thinks the generation is 322292
> Superblock thinks the level is 1
> Found tree root at 649710272512 gen 322292 level 1
>
> How do I use this information? Is there reason to be optimistic?

No. The best possible case is data raid0, and metadata raid1, in which
case the file system will mount with "degraded" option and you'll be
able to recover any files that are completely on the intact device,
and not subject to any striping. Otherwise they will be considered by
Btrfs to be corrupt/missing, although I'm not sure if it results in
EIO or something else. If metadata is also raid0, then the file system
won't mount. You probably also won't have much success with btrfs
restore either.


-- 
Chris Murphy