Re: filesystem finder / fixer

[Martin Steigerwald <Martin@lichtvoll.de>]

Am Freitag, 3. August 2012 schrieb serialhex@lavabit.com:
> > Alex Elsayed wrote:
> > 
> > Just realized I messed up sending this to the list.
> > 
> > Roman Mamedov wrote:
> >> On Mon, 30 Jul 2012 23:26:42 -0400 (EDT)
> >> 
> >> serialhex@lavabit.com wrote:
> >>> 1) is there a tool to help me recover data from my fs? I don't have
> >>> a backup of my partition table and so I have about 500GB of space
> >>> where a few partitionns might reside... GPT partitions mind you
> >> 
> >> If you only lost the partition table, there's a tool
> >> (strangely)named TestDisk, which can find the actual partitions on
> >> disk and restore it. Don't know if it supports GPT and BTRFS,
> >> though.
> > 
> > If TestDisk doesn't support it, then you may be able to do it
> > manually with
> > some trial and error.
> > 
> > I just dumped the first 4 megabytes of my disk, and it looks like at
> > offset
> > 0x10040 (64K + 64 bytes) there's the string BHRfS (hex 5F 42 48 52 66
> > 53 5f). That matches the documentation (the first superblock should
> > be at 64K).
> 
> ok, so it's been a few days, because it took me a few days to get
> everything back up and running, but here's what i did:
> 
> (tl;dr - i got my data back!)
> 
> i did as Alex suggested.  but i was getting a *lot* of false positives.
> the string _BHRfS_H is in the source code, some binaries, or
> something.... so the fact that bits are bits when reading the device
> as a file, i have to ignore all of those.  then there were a handful
> of other ones that looked to be the first superblock, but every time i
> tried it didn't work...  so i read up on btrfs some more.  the
> _BHRfS_H string starts at 0x40 (64 bytes) and the first bytes are a
> checksum of everything after. so i started with that, and found a
> number of the _BHRfS_H strings to have 00's before it, so a checksum
> of zero... which is *HIGHLY* unlikely.  so i looked for that, and the
> first one i found with a checksum >0 i tried, and succeeded!!
> 
> Thanks for the help & advice!!  i've now got my stuff back (and need to
> do an actual backup :P )

Now that would be either a good addition to testdisk or gpart if not 
already there or a nice thing for a btrfs recovery tool. Find my BTRFS 
partition. ;)

I think I will update my backup script to do sfdisk -d or gdisk -something 
> /root/partitioning before backuping ;). Always wanted to do that ;).

-- 
Martin 'Helios' Steigerwald - http://www.Lichtvoll.de
GPG: 03B0 0D6C 0040 0710 4AFA  B82F 991B EAAC A599 84C7