Hello guys,

 

I accidentally removed a vm disk stored on my cache disk (btrfs - encrypted)

 

I found this thread where a method is shown to find old blocks (filesystem tables?) on the btrfs partitition and recover missing files from there. More Info on 'btrfs restore'

 

I stopped my array and re-started it into maintenance mode, so the luks-volume is decrypted.

 

I then let the system print out the blocks, which already mentions issues:

btrfs-find-root /dev/mapper/sdb1
Superblock thinks the generation is 1948419
Superblock thinks the level is 0
Found tree root at 114811912192 gen 1948419 level 0
Well block 114811895808(gen: 1948418 level: 0) seems good, but generation/level doesn't match, want gen: 1948419 level: 0
Well block 114710626304(gen: 1948417 level: 0) seems good, but generation/level doesn't match, want gen: 1948419 level: 0
Well block 114683527168(gen: 1948416 level: 0) seems good, but generation/level doesn't match, want gen: 1948419 level: 0
Well block 114675793920(gen: 1948415 level: 0) seems good, but generation/level doesn't match, want gen: 1948419 level: 0
Well block 114660343808(gen: 1948414 level: 0) seems good, but generation/level doesn't match, want gen: 1948419 level: 0
Well block 114648399872(gen: 1948413 level: 0) seems good, but generation/level doesn't match, want gen: 1948419 level: 0
Well block 114625986560(gen: 1948412 level: 0) seems good, but generation/level doesn't match, want gen: 1948419 level: 0

[...]

 

When I try to search these blocks for files, something continues to be problematic:

btrfs restore -Div -t 114811895808 --path-regex '^/(|mnt(|/user(|/domains(|/.*))))$' /dev/mapper/sdg1 /root
parent transid verify failed on 114811895808 wanted 1948419 found 1948418
parent transid verify failed on 114811895808 wanted 1948419 found 1948418
parent transid verify failed on 114811895808 wanted 1948419 found 1948418
Ignoring transid failure
This is a dry-run, no files are going to be restored

 

 

Could someone please help me from here, or suggest some other solution?

 

Thanks!!

Something like UFS explorer would be your best bet, but encryption will complicate things, I think only the very expensive enterprise version supports that.

28 minutes ago, JorgeB said:

Something like UFS explorer would be your best bet, but encryption will complicate things, I think only the very expensive enterprise version supports that.

 

Yes, looked it up: Only the professional version at 599 € supports luks-encryption.. That's not an option..

Just for the record:

 

The problem was that you have to have both btrfs disks present and decrypted when trying to mount them. So mounting them worked like this

 

# decrypt the disks
cryptsetup luksOpen /dev/mapper/sdb1 cachedisk1
cryptsetup luksOpen /dev/mapper/sdg1 cachedisk2

# you could mount the array by: (mounting either one of them mounts both as a RAID array.)
mkdir /root/cachedisk
mount /dev/mapper/cachedisk1 /root/cachedisk

# But for the following operations they have to me unmounted
umount /root/cachedisk

 

I found a script that searches for the most recent version of a file in the btrfs filesystem, supposedly finding deleted files aswell.

 

# Download the script
cd /root
wget https://gist.githubusercontent.com/Changaco/45f8d171027ea2655d74/raw/a868234e951a068ff12c9683e1500a20fe60de90/btrfs-undelete
chmod +x ./btrfs-undelete

# Run the script, pointing it to a directory where to put found files
./btrfs-undelete /dev/mapper/cachedisk1 <file> <output-dir>

 

However in my case this didn't recover my missign file. Probably because directly after deleting it, I wrote some other data to the cache drive, possibly overwriting the missing file.