[SOLVED] recover files after accidental formatting of zfs

cory.schwartz · 2011-03-15 01:35:02

Ok, Let it the 'you are an idiot' comments roll...

Long version:
I wanted to play with zfs, so I was installing freebsd alongside my typical arch installation. During the installation, I was astonished to realize that I must have been confused by the BSD drive naming convention because I had overwritten my data partition with zfs. Of course (I am an idiot) and I had no backup.

short version:
Used to have an ext4 partition that had some files on it. Now I have a zfs partition that has no files on it.

I did not do ANYTHING after I realized the mistake. I didn't even finish the installation. To the best of my knowledge, it has never even been mounted.

What utilities give me the best chance of recovery? Is there anything specific I should know about this specific situation, recovering a journeled file system out of zfs?

Last edited by cory.schwartz (2011-03-15 16:14:48)

jasonwryan · 2011-03-15 02:08:52

I don't know about your specific situation, but you might want to try photorec:

Arch Wiki wrote:

PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even if your media's filesystem has been severely damaged or re-formatted

https://wiki.archlinux.org/index.php/File_Recovery

cory.schwartz · 2011-03-15 02:20:07

Thanks for the reply. I'm reading the wiki now; photorec looks like it will only recover photos. I want to recover python programs.

According to the wiki you just gave me, TestDisk can recover files from partitions that have been removed from the MBR, but it doesn't mention reformatting. I'm going to do some more research on that one.

cory.schwartz · 2011-03-15 02:52:26

Turns out that TestDisk was IS in fact capable of recovering lost partitions after they have been deleted, or sometimes reformatted. According to their wiki, they do not support ZFS filesystem, so I decided to try it in hopes that it would still recover TO a zfs partition.

And, I happen to have a copy of TestDisk handy on my Parted Magic CD.

Steps taken:
-From the main menu on Test disk, Select advanced.
-Select analyze partition data.
-This correctly identified my old linux partitions, and they were marked with a D which means they were 'deleted'. I don't know if it is completely right, because I never bothered to write down the specific Hard Drive geometry before, but it looks right to me.
-hit 'Write' to write the corrected partition table to disk.
-I was able to see recovered files through the testdisk program, but I'll have to reboot for the kernel become aware of the partitions and let me mount them. So I'll be back in 5 minutes to report whether this worked.

cory.schwartz · 2011-03-15 03:13:30

After recovery, all partitions are now happily where they once were.
I can mount them, copy files to and from and nothing seems to be missing.

I cannot vouch that TestDisk works for ALL cases of accidental formatting, but it certainly worked in this case.

Thanks to jasonwryan for pointing me in the wiki and leading me in the right direction. I am going to do a bit more research on what this program can do, although I hope I never need it again.

jasonwryan · 2011-03-15 03:26:22

Glad you got it sorted. FWIW, photorec does recover other types of files.

Please mark your thread as [Solved] -- and make a backup of your data

Arch Linux

#1 2011-03-15 01:35:02

[SOLVED] recover files after accidental formatting of zfs

#2 2011-03-15 02:08:52

Re: [SOLVED] recover files after accidental formatting of zfs

#3 2011-03-15 02:20:07

Re: [SOLVED] recover files after accidental formatting of zfs

#4 2011-03-15 02:52:26

Re: [SOLVED] recover files after accidental formatting of zfs

#5 2011-03-15 03:13:30

Re: [SOLVED] recover files after accidental formatting of zfs

#6 2011-03-15 03:26:22

Re: [SOLVED] recover files after accidental formatting of zfs

Board footer