Re: filesystem finder / fixer
From: Martin Steigerwald <hidden>
Date: 2012-08-04 09:19:50
Am Freitag, 3. August 2012 schrieb serialhex@lavabit.com:
quoted
Alex Elsayed wrote: Just realized I messed up sending this to the list. Roman Mamedov wrote:quoted
On Mon, 30 Jul 2012 23:26:42 -0400 (EDT) serialhex@lavabit.com wrote:quoted
1) is there a tool to help me recover data from my fs? I don't have a backup of my partition table and so I have about 500GB of space where a few partitionns might reside... GPT partitions mind youIf you only lost the partition table, there's a tool (strangely)named TestDisk, which can find the actual partitions on disk and restore it. Don't know if it supports GPT and BTRFS, though.If TestDisk doesn't support it, then you may be able to do it manually with some trial and error. I just dumped the first 4 megabytes of my disk, and it looks like at offset 0x10040 (64K + 64 bytes) there's the string BHRfS (hex 5F 42 48 52 66 53 5f). That matches the documentation (the first superblock should be at 64K).ok, so it's been a few days, because it took me a few days to get everything back up and running, but here's what i did: (tl;dr - i got my data back!) i did as Alex suggested. but i was getting a *lot* of false positives. the string _BHRfS_H is in the source code, some binaries, or something.... so the fact that bits are bits when reading the device as a file, i have to ignore all of those. then there were a handful of other ones that looked to be the first superblock, but every time i tried it didn't work... so i read up on btrfs some more. the _BHRfS_H string starts at 0x40 (64 bytes) and the first bytes are a checksum of everything after. so i started with that, and found a number of the _BHRfS_H strings to have 00's before it, so a checksum of zero... which is *HIGHLY* unlikely. so i looked for that, and the first one i found with a checksum >0 i tried, and succeeded!! Thanks for the help & advice!! i've now got my stuff back (and need to do an actual backup :P )
Now that would be either a good addition to testdisk or gpart if not already there or a nice thing for a btrfs recovery tool. Find my BTRFS partition. ;) I think I will update my backup script to do sfdisk -d or gdisk -something
/root/partitioning before backuping ;). Always wanted to do that ;).
-- Martin 'Helios' Steigerwald - http://www.Lichtvoll.de GPG: 03B0 0D6C 0040 0710 4AFA B82F 991B EAAC A599 84C7