Thank you all for your help. Magically, btrfs-find-root worked today. (I attached the steps at the end) I don't think I changed anything. The btrfs-progs version is still 4.1 because I tried different tagged versions (starting from 4.9) from the cloned git repo.
The btrfs-find-root on the working / of my computer (Intel [email protected] on a Samsung 850EVO) took several seconds. btrfs-find-root on the 60GB dd-image (on the same computer on a 960EVO ssd) loop device took 6 minutes until it stared asking me "do you want to keep going on ? (y/N/a): We seem to be looping a lot on..." questions. I answered them with yes. The command was finished then 1 minute later. - just for a reference, if somebody wonders, how many days one has to wait. Strangely, the second run of btrfs-find-root finished differently. The first run did not mention the snapshots. This also confirms my suspicion, that the tool is working far from perfectly. It's absolutely clear that I came here because of my stupidity (making a dd backup of my live btrfs root partition), but it really frightens me how quickly (2 days reading/trying wiki/blog/mailing list solutions) I came to the point of having to grep text files by its contents from my image.dd. I don't run database computer center, so I'm not relying on the nice btrfs features. But, for my next clean installation I will rather use ext4 just because there are tons of forensic/recovery tools available for the worst case. Thank you again for your quick and helpful answers. Cheers, Michael PS: I now just took the NetworkManager settings to not have to enter all Wifi details when traveling. So, it was really mostly an exercise. linux-2bf5:/home/michael # losetup -f /dev/loop0 linux-2bf5:/home/michael # losetup /dev/loop0 ./20170126_sda2root.dd linux-2bf5:/home/michael # btrfs fi show Label: none uuid: 779e9c04-be4b-4a45-9fc2-000acca5549d Total devices 1 FS bytes used 19.02GiB devid 1 size 118.16GiB used 25.03GiB path /dev/sda4 Label: none uuid: 91a79eeb-08e0-470e-beab-916b38e09aca Total devices 1 FS bytes used 44.22GiB devid 1 size 60.00GiB used 60.00GiB path /dev/loop0 linux-2bf5:/home/michael # linux-2bf5:/home/michael/btrfs-progs # ./btrfs fi show Label: none uuid: 779e9c04-be4b-4a45-9fc2-000acca5549d Total devices 1 FS bytes used 19.02GiB devid 1 size 118.16GiB used 25.03GiB path /dev/sda4 Label: none uuid: 91a79eeb-08e0-470e-beab-916b38e09aca Total devices 1 FS bytes used 44.22GiB devid 1 size 60.00GiB used 60.00GiB path /dev/loop0 btrfs-progs v4.1 linux-2bf5:/home/michael/btrfs-progs # ./btrfs-find-root /dev/sda4 Superblock thinks the generation is 14210 Superblock thinks the level is 1 Found tree root at 12232638464 gen 14210 level 1 Well block 12173475840(gen: 14209 level: 1) seems good, but generation/level doesn't match, want gen: 14210 level: 1 Well block 12081152000(gen: 14198 level: 1) seems good, but generation/level doesn't match, want gen: 14210 level: 1 linux-2bf5:/home/michael/btrfs-progs # ./btrfs-find-root /dev/loop0 Couldn't read tree root Superblock thinks the generation is 549995 Superblock thinks the level is 1 Well block 32794263552(gen: 550001 level: 1) seems good, but generation/level doesn't match, want gen: 549995 level: 1 linux-2bf5:/home/michael/btrfs-progs # linux-2bf5:/home/michael/btrfs-progs # ./btrfs restore -t 32794263552 /dev/loop0 /home/michael/btrfs/ parent transid verify failed on 32794263552 wanted 549995 found 550001 parent transid verify failed on 32794263552 wanted 549995 found 550001 Ignoring transid failure We seem to be looping a lot on /home/michael/btrfs/var/log/audit/audit.log.4, do you want to keep going on ? (y/N/a): y We seem to be looping a lot on /home/michael/btrfs/var/log/audit/audit.log.3, do you want to keep going on ? (y/N/a): We seem to be looping a lot on /home/michael/btrfs/var/log/audit/audit.log.2, do you want to keep going on ? (y/N/a): y We seem to be looping a lot on /home/michael/btrfs/var/log/audit/audit.log.1, do you want to keep going on ? (y/N/a): We seem to be looping a lot on /home/michael/btrfs/var/tmp/kdecache-miborn/plasma_theme_openSUSElight_v0.5.kcache, do you want to keep going on ? (y/N/a): y Error writing: 28 No space left on device Error copying data for /home/michael/btrfs/var/cache/cups/ppds.dat Error searching /home/michael/btrfs/var/cache/cups/ppds.dat Error searching /home/michael/btrfs/var/cache/cups/ppds.dat Error searching /home/michael/btrfs/var/cache/cups/ppds.dat We seem to be looping a lot on /home/michael/btrfs/var/tmp/kdecache-miborn/plasma_theme_openSUSElight_v0.5.kcache, do you want to keep going on ? (y/N/a): linux-2bf5:/home/michael/btrfs-progs # linux-2bf5:/home/michael/btrfs-progs # ./btrfs restore -t 32794263552 /dev/loop0 /home/michael/btrfs/ parent transid verify failed on 32794263552 wanted 549995 found 550001 parent transid verify failed on 32794263552 wanted 549995 found 550001 Ignoring transid failure We seem to be looping a lot on /home/michael/btrfs/var/log/audit/audit.log.4, do you want to keep going on ? (y/N/a): y We seem to be looping a lot on /home/michael/btrfs/var/log/audit/audit.log.3, do you want to keep going on ? (y/N/a): We seem to be looping a lot on /home/michael/btrfs/var/log/audit/audit.log.2, do you want to keep going on ? (y/N/a): y We seem to be looping a lot on /home/michael/btrfs/var/log/audit/audit.log.1, do you want to keep going on ? (y/N/a): We seem to be looping a lot on /home/michael/btrfs/var/tmp/kdecache-miborn/plasma_theme_openSUSElight_v0.5.kcache, do you want to keep going on ? (y/N/a): y We seem to be looping a lot on /home/michael/btrfs/var/tmp/kdecache-miborn/plasma_theme_openSUSElight_v0.5.kcache, do you want to keep going on ? (y/N/a): Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot Skipping snapshot snapshot linux-2bf5:/home/michael/btrfs-progs # Am 31.01.2017 um 03:30 schrieb Lakshmipathi.G: >> >> Does someone on the list know if ext3/4 data recovery tools can also >> search btrfs data? That's another option. >> >> Gordon >> > ext3/4 (or other) data recovery tools can help, if they have generic > file search mode not tied to specific file systems. > Have a look at ext4magic > http://ext4magic.sourceforge.net/ext4magic_en.html - It said to have > file carving option. Though I'm not sure whether it accepts non-ext file > system. > > And there is https://github.com/Lakshmipathi/extcarve (supports > different FS) but I never updated it in years, so skeptical about it. I > guess this https://github.com/sleuthkit/sleuthkit may be your best bet. > > If want to take recovery tool route - remember to backup original dd > image file. > ---- > Cheers, > Lakshmipathi.G -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
