Alex Elsayed wrote:

Just realized I messed up sending this to the list.

Roman Mamedov wrote:

quoted

On Mon, 30 Jul 2012 23:26:42 -0400 (EDT)
serialhex@lavabit.com wrote:

quoted

1) is there a tool to help me recover data from my fs? I don't have a
backup of my partition table and so I have about 500GB of space where a
few partitionns might reside... GPT partitions mind you

If you only lost the partition table, there's a tool (strangely)named
TestDisk, which can find the actual partitions on disk and restore it.
Don't know if it supports GPT and BTRFS, though.

If TestDisk doesn't support it, then you may be able to do it manually
with
some trial and error.

I just dumped the first 4 megabytes of my disk, and it looks like at
offset
0x10040 (64K + 64 bytes) there's the string BHRfS (hex 5F 42 48 52 66 53
5f). That matches the documentation (the first superblock should be at
64K).

ok, so it's been a few days, because it took me a few days to get
everything back up and running, but here's what i did:

(tl;dr - i got my data back!)

i did as Alex suggested.  but i was getting a *lot* of false positives. 
the string _BHRfS_H is in the source code, some binaries, or something....
so the fact that bits are bits when reading the device as a file, i have
to ignore all of those.  then there were a handful of other ones that
looked to be the first superblock, but every time i tried it didn't
work...  so i read up on btrfs some more.  the _BHRfS_H string starts at
0x40 (64 bytes) and the first bytes are a checksum of everything after. 
so i started with that, and found a number of the _BHRfS_H strings to have
00's before it, so a checksum of zero... which is *HIGHLY* unlikely.  so i
looked for that, and the first one i found with a checksum >0 i tried, and
succeeded!!

Thanks for the help & advice!!  i've now got my stuff back (and need to do
an actual backup :P )

hex