Re: undelete files

["Massimo B." <massimo.b@gmx.net>]

Hello,

I had a similar issue. On OpenSuse I deleted /.snapshots/ and was not aware that
/.snapshots/1/snapshot/ is the default subvolume representing my root file
system.
So I had no snapshot left, all ro subvolumes have been deleted before, and the
default subvolume had big parts deleted before I cancelled the rm -rfv. I kept a
copy of the STDOUT listing the deleted files and switched off the power of that
filesystem immediately, no sync or umount.
There have been no additional writes, so I was quite sure the data must still be
there.

I booted a live version of the OpenSuse TW. However btrfsprogs are missing the
important btrfs-find-root, so I compiled the progs from the very recent github
revision.

After I played with the btrfs restore and --path-regex I had no success, finding
some of the files that have been deleted.
I found a copy of the btrfs-undelete script and played with that:
https://gist.github.com/Changaco/45f8d171027ea2655d74

I learned how to traverse the root-ids to older generations, but the script
found absolutely none of the deleted files.
I modified the script to use btrfs-find-root -a which found some more root-ids
but still no success, for instance:

# btrfs-undelete /dev/mapper/_root "/@/.snapshots/1/snapshot/etc/cron.daily/1btrk.cron" /mnt/usb/rescue
Trying root 88866816... (329/332)
Trying root 66764800... (330/332)
Trying root 66600960... (331/332)
Trying root 60571648... (332/332)
Didn't find '@/.snapshots/1/snapshot/etc/cron.daily/1btrk.cron'

I did not trust the obscure --path-regex.

I also reproduced what the script does, using regular expressions like
'^/(|@(|/.snapshots(|/1(|/snapshot(|/etc(|/cron.daily(|/1btrbk.cron)))))))$'

However I did some btrfs restore --dry-run and grepped the known files myself,
until I found older root-ids containing almost all of the missing files with
meta-data. The snippets I like to share here:

# btrfs-find-root -a /dev/mapper/_root |grep Well |cut -d '(' -f 1 |awk '{print $3}' | while read -r rootid ; do echo "### rootid: $rootid"; btrfs restore -t $rootid -Dvi /dev/mapper/_root /mnt/usb/rescue/;done 2>/dev/null |grep -e "### rootid" -e "1btrbk.cron"

### rootid: 245530624
### rootid: 245022720
### rootid: 244760576
### rootid: 242139136
### rootid: 242892800
### rootid: 241942528
### rootid: 209518592
### rootid: 144097280
### rootid: 147816448
Restoring /mnt/usb/rescue/@/.snapshots/1/snapshot/etc/cron.daily/1btrbk.cron
### rootid: 123863040
Restoring /mnt/usb/rescue/@/.snapshots/1/snapshot/etc/cron.daily/1btrbk.cron

Best regards,
Massimo