Arch Linux

b0ss_

Member

Registered: 2021-01-16

Posts: 83

[ISSUE] Recover a BTRFS partition

Let me start this post saying that this was my fault because I didn't read the wiki properly. I was following this wiki to open my LUKS encrypted partition. This was my first time ever using BTRFS+LUKS and I didn't make the partition nor the encryption (I used the archinstaller when it came out because it was late at night). So, I used the command:

cryptsetup-reencrypt --decrypt /dev/sda2

To "open" my filesystem. Oh, but turns out it actually was going to decrypt everything, so I made a ^C. And in that moment, everything started to go down. I ran a couple of chunk recovery tools that came in the Arch installer 2021.5 to recover all (or just a few) chunks of data. From what I could recover, there was 701 broken chunks, 445 were recovered, and 256 were not recovered.
I've been reading similar issues from a couple of years ago (maybe the more up-to-date was a post I read from 2017 and the guy in the post just deleted the entire partition and made a new one).

I don't know if nowadays things are different and maybe I can recover those other chunks. I tried mounting the partition with:

mount ro,recovery /dev/sda2 /mnt

But didn't work. Not that it amazes me, but hey. I tried.

Last night I left photorec recovering files from the partition and it kinda worked (it recovered 26gb of garbage files, but I was able to recognize some of them, although the entire partition was using about 700gb~).

I know I deserve a slap in the face but I need to know: Is there something I can do?

Thanks.

Edit: I forgot to say that right now I'm booting GParted Live and GParted it's checking the partition.
Edit 2: Failed:

The GParted check failed:

checksum verify failed on 390725632 found 00000095 wanted 00000002
checksum verify failed on 390725632 found 000000B1 wanted 0000000A
checksum verify failed on 390725632 found 00000095 wanted 00000002
bad tree block 390725632, bytenr mismatch, want=390725632, have=4993660831223472557
Couldn't read tree root
ERROR: cannot open file system

Also, the error that the mount command throws is this:

mount: /mnt: wrong fs type, bad option, bad superblock on /dev/sda2, missing codepage or helper program, or other error.

Last edited by b0ss_ (2021-08-29 18:28:30)

Ammako

Member

Registered: 2021-07-16

Posts: 267

Re: [ISSUE] Recover a BTRFS partition

If anything on there is actually important, highly recommended you make a backup copy of that partition first, before doing anything potentially destructive. If there's a chance to recover some data it's best to avoid risking making it worse in the process.

What were you trying to do by running "cryptsetup-reencrypt --decrypt", and what made you think this is what you needed to do? For future reference, to avoid getting into this situation again, if you're just looking to open/unlock your partition, "cryptsetup luksOpen [partition] [mapper name]" is what you want.

Last edited by Ammako (2021-08-29 18:29:32)

b0ss_

Member

Registered: 2021-01-16

Posts: 83

Re: [ISSUE] Recover a BTRFS partition

If anything on there is actually important, highly recommended you make a backup copy of that partition first, before doing anything potentially destructive. If there's a chance to recover some data it's best to avoid risking making it worse in the process.

How can I do this? Can I make it with:

dd if=/dev/sda2 of=/mnt

If there's other way to do this or an easier or better one, please tell. Thanks!

b0ss_

Member

Registered: 2021-01-16

Posts: 83

Re: [ISSUE] Recover a BTRFS partition

If anything on there is actually important, highly recommended you make a backup copy of that partition first, before doing anything potentially destructive. If there's a chance to recover some data it's best to avoid risking making it worse in the process.

How can I do this? Can I make it with:

dd if=/dev/sda2 of=/mnt

If there's other way to do this or an easier or better one, please tell. Thanks!

EDIT: I formatted an old 1TB Seagate HDD and made it BTRFS and started

dd if=/dev/sda2 of=/dev/sdb1 status=progress

So the disk will be backed up.

b0ss_

Member

Registered: 2021-01-16

Posts: 83

Re: [ISSUE] Recover a BTRFS partition

its 04:50am, the disk was backed up after maybe 14 hours. how shall I proceed?

progandy

Member

Registered: 2012-05-17

Posts: 5,317

Re: [ISSUE] Recover a BTRFS partition

I believe the only real option might be to complete the decryption with cryptsetup-reencrypt. That only works if you still have the temporary LUKS-... files. Your chunk recovery steps might have rendered it unrecoverable as well.

Last edited by progandy (2021-08-30 09:03:27)

---

| alias CUTF='LANG=en_XX.UTF-8@POSIX ' | alias ENGLISH='LANG=C.UTF-8 ' |

b0ss_

Member

Registered: 2021-01-16

Posts: 83

Re: [ISSUE] Recover a BTRFS partition

I believe the only real option might be to complete the decryption with cryptsetup-reencrypt. That only works if you still have the temporary LUKS-... files. Your chunk recovery steps might have rendered it unrecoverable as well.

 $ sudo cryptsetup-reencrypt --decrypt /dev/sdb1
Device /dev/sdb1 is not a valid LUKS device.

 $ sudo hexdump -C /dev/sdb1 | head -20
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00010000  e2 c2 41 b1 00 00 00 00  00 00 00 00 00 00 00 00  |..A.............|
00010010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00010020  0c 2c d2 ee f4 eb 46 6e  8f 05 62 a5 a1 2b a5 25  |.,....Fn..b..+.%|
00010030  00 00 01 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00010040  5f 42 48 52 66 53 5f 4d  d3 a3 01 00 00 00 00 00  |_BHRfS_M........|
00010050  00 00 4a 17 00 00 00 00  00 00 50 01 00 00 00 00  |..J.......P.....|
00010060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00010070  00 00 c0 bf e8 00 00 00  00 20 a2 57 92 00 00 00  |......... .W....|
00010080  06 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00010090  00 10 00 00 00 40 00 00  00 40 00 00 00 10 00 00  |.....@...@......|
000100a0  81 00 00 00 7f 93 01 00  00 00 00 00 00 00 00 00  |................|
000100b0  00 00 00 00 00 00 00 00  00 00 00 00 61 01 00 00  |............a...|
000100c0  00 00 00 00 00 00 01 01  00 01 00 00 00 00 00 00  |................|
000100d0  00 00 00 c0 bf e8 00 00  00 00 00 80 c1 98 00 00  |................|
000100e0  00 00 10 00 00 00 10 00  00 00 10 00 00 00 00 00  |................|
000100f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00010100  00 00 00 00 00 00 00 00  00 00 00 e1 4a bb ab 37  |............J..7|
00010110  27 42 47 af 46 58 ae 11  1c 4c 02 0c 2c d2 ee f4  |'BG.FX...L..,...|

Well, this is the backup disk, so maybe that's why it doesn't has any LUKS hexcode.

# cryptsetup-reencrypt --decrypt /dev/sda2
Device /dev/sda2 is not a valid LUKS device.

# hexdump -C /dev/sda2 | head -20

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00010000  e2 c2 41 b1 00 00 00 00  00 00 00 00 00 00 00 00  |..A.............|
00010010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00010020  0c 2c d2 ee f4 eb 46 6e  8f 05 62 a5 a1 2b a5 25  |.,....Fn..b..+.%|
00010030  00 00 01 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00010040  5f 42 48 52 66 53 5f 4d  d3 a3 01 00 00 00 00 00  |_BHRfS_M........|
00010050  00 00 4a 17 00 00 00 00  00 00 50 01 00 00 00 00  |..J.......P.....|
00010060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00010070  00 00 c0 bf e8 00 00 00  00 20 a2 57 92 00 00 00  |......... .W....|
00010080  06 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00010090  00 10 00 00 00 40 00 00  00 40 00 00 00 10 00 00  |.....@...@......|
000100a0  81 00 00 00 7f 93 01 00  00 00 00 00 00 00 00 00  |................|
000100b0  00 00 00 00 00 00 00 00  00 00 00 00 61 01 00 00  |............a...|
000100c0  00 00 00 00 00 00 01 01  00 01 00 00 00 00 00 00  |................|
000100d0  00 00 00 c0 bf e8 00 00  00 00 00 80 c1 98 00 00  |................|
000100e0  00 00 10 00 00 00 10 00  00 00 10 00 00 00 00 00  |................|
000100f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00010100  00 00 00 00 00 00 00 00  00 00 00 e1 4a bb ab 37  |............J..7|
00010110  27 42 47 af 46 58 ae 11  1c 4c 02 0c 2c d2 ee f4  |'BG.FX...L..,...|

Well, it completely lost the LUKS encryption. I've been checking the hexdump, and until the 00124000 block, I'm seeing lots of zeroes, but until there, I'm reading a more "proper" hexdump (since I'm comparing another partition hexdump to this one). I've also been reading this page on the Btrfs wiki. I have this info dump I took a couple of days ago (I believe it's a btrfs-find-root output)

Superblock thinks the generation is 107475
Superblock thinks the level is 1
Well block 330629120(gen: 107469 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 324091904(gen: 107468 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 273563648(gen: 107467 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 249888768(gen: 107466 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 244498432(gen: 107465 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 214974464(gen: 107464 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 59031552(gen: 107463 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 34652160(gen: 107462 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 31768576(gen: 107461 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 249413632(gen: 107460 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 179781632(gen: 107459 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 178339840(gen: 107458 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 128122880(gen: 107458 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 128090112(gen: 107458 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 55934976(gen: 107457 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 182206464(gen: 107456 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 273547264(gen: 107434 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 224100352(gen: 107434 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 58966016(gen: 107391 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 49528832(gen: 107390 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 49512448(gen: 107390 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 41943040(gen: 107390 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 246415360(gen: 106991 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 163872768(gen: 106988 level: 1) seems good, but generation/level doesn't match, want gen: 107475 level: 1
Well block 50495488(gen: 106967 level: 0) seems good, but generation/level doesn't match, want gen: 107475 level: 1

I tried running a btrfs restore with the dry option and got this output:

 $ sudo btrfs restore /dev/sdd1 (the drive code changed, don't know why) -D /mnt
checksum verify failed on 390725632 wanted 0x027cd7da found 0x95108021
checksum verify failed on 390725632 wanted 0x0ad60289 found 0xb1c0879c
checksum verify failed on 390725632 wanted 0x027cd7da found 0x95108021
bad tree block 390725632, bytenr mismatch, want=390725632, have=4993660831223472557
Couldn't read tree root
Could not open root, trying backup super
checksum verify failed on 390725632 wanted 0x027cd7da found 0x95108021
checksum verify failed on 390725632 wanted 0x0ad60289 found 0xb1c0879c
checksum verify failed on 390725632 wanted 0x027cd7da found 0x95108021
bad tree block 390725632, bytenr mismatch, want=390725632, have=4993660831223472557
Couldn't read tree root
Could not open root, trying backup super
No valid Btrfs found on /dev/sdd1
Could not open root, trying backup super

Is there a way to modify what the checksum receives and what not? I have lots of time, since I can't sleep anymore. Is there something, anything I could to to recover at least a small amount of data?

Edit: Even if it's dangerous, or the last resort, I need to know it. I don't think I have much options right now and I would rather try to give it all up for just a fraction of my data, or maybe even nothing. But something. I don't want to just format my HDD. If there's something I could do, I will do it

Edit2: dmesg output after trying to mount the backup drive:

# mount -t btrfs -o ro,recovery /dev/sde1 /mnt
mount: /mnt: wrong fs type, bad option, bad superblock on /dev/sde1, missing codepage or helper program, or other error.
# dmesg
[438168.602668] BTRFS info (device sde1): disk space caching is enabled
[438168.602688] BTRFS info (device sde1): has skinny extents
[438168.976665] BTRFS error (device sde1): bad tree block start, want 390725632 have 4993660831223472557
[438168.985080] BTRFS error (device sde1): bad tree block start, want 390725632 have 5707248463982133654
[438168.985145] BTRFS warning (device sde1): couldn't read tree root
[438168.986270] BTRFS error (device sde1): open_ctree failed

Last edited by b0ss_ (2021-08-30 20:26:30)