Is there a way to recover a lost btrfs tumbleweed partition?

English Install/Boot/Login
1

I had a dual setup with Windows and Tumbleweed. I tried to apply a Windows update that required some partitioning, but I used an automated script by Microsoft and it wiped out my Suse partition, which is tragic because I had it already configured top notch and had some important files there, including a collection of downloaded classic Linux pictures from Linux olden days, my own openSUSE screenshots with my custom themes, and some txts where I assembled all my favorite Linux software for everything, including links and reviews, as well as a collection of txts about how to setup openSUSE from the beginning, including just about every aspect, including cleanup tutorials, things to after installing and such things, also some opinions on how Ubuntu has decayed lately.

Anyway,. I want to recover those files, and I simply can’t find how. I tried to recover the lost btrfs partition with testdisk, but it only restored the former partition table, which I doubt is the exact one since I think Windows recovery had grown by a few MB with the script, so in order to be able to rescue something, I deleted the two win recovery partitions that were immediately before and after my SUSE partition.

Now with testdisk, I could restore the partition table, supposedly, but I don’t think it recovered the exact whereabouts, since I had a swap and the main btrfs, and testdisk only listed a deleted “extended” partition, but said “this partition can’t be recovered!”.

Yet I know the data can be recovered because right now I’m using photorec to rescue all those files non-destructrively to my Windows partition, which is independent from the Linux space in question, and apparently it is rescuing a whole load of them with the contents intact, but they are so many, and they are being recovered without the folder structure, thus making it impossible to browse without adding overkill effort in renaming, etc.

So now that I know the files are intact, I’d like to know if there is a way to recover the original partition, with its original folder structure, and the original filenames in a non-destructive manner. I tried to dd the image of what was recovered at first from those partitions but it didn’t mount, copied the dd to VirtualBox but I couldn’t produce any of its contents .

Any suggestions?

2

btrfs magic string in the superblock is _BHRfS_M (8 bytes). You can search for this magic string. If found, it will give the location of the superblock which is at the fixed offset from the partition start.

3

Ok but where do I find it, with what software, how? And can I repartition using that information with testdisk from Windows?

4

Please explain, “Windows update that required some partitioning”?

5

It is one of the latest updates for Win10, which has a long standing bug, if recovery partition is less than 500 MB the update fails, and it tried to update daily AND everyday it fails, so I downloaded an automatic fix by MS from

Without knowing it would fail and wipe my SUSE partition too. So now I have a half recovered extended partition that wont mount, and I dont know if it includes just the btrfs or the swap too or if its positioned right, or if the script robbed it a few MB, yet the files keep coming out of it by the hundreds of thousands, only HTMLs have filenames, and no folder structure, which Is too much to search.

6

IMG-20240712-WA0012
IMG-20240712-WA00121600×900 284 KB

IMG-20240712-WA0011
IMG-20240712-WA00111600×900 337 KB

This was the setup, now probably gone forever (I hope I can recover it) but It was so smooth, fast and loaded with software, only an occasional bug that hanged the desktop while discover upgraded, but I had Desktop icons for zypper refresh and dup

7

Did it ‘wipe’ the SUSE partition or remove GRUB?

8

The partition I think, because grub showed an error

9

So you’re unaware exactly what the “automatic fix by MS” did?
Hint: Have you viewed the disk with a partition manager to see what actually exists on the drive?

10

I saw that it deleted the Linux partition because after I ran it, I checked with Windows partition manager and Linux was gone, and when I rebooted indeed the grub was empty and in recovery mode, but by now I deleted all three partitions: those 2 recoveries contiguous to Linux, and the unmountable Linux extended that testdisk supposedly recovered from deletion. Still, with 3rd party software I still can see the files and they seem to be easy to recover, but they’re not showing any filenames or file structure because those file recoverer programs only throw them by extension into random folders. So I’d like to know if there’s a way I can recover the most I can of my original file structure and brtfs partition, but I don’t know what software to use (right now I only have Windows, I wouldn’t know what to do to recover if I booted from a live Linux USB. So far most I’ve done is remove the 3 partitions because I suspected the positions were wrong afterwards, but I haven’t formatted or written on them until I find a way to recover and access them in their full structure, I mean, the files seem to somehow still be uncorrupted, they even show in high resolution in 3rd program software.

11

If it overwrote any of the data, then the data is unlikely to be recoverable. Repartitioning the drive very likely destroyed the data.

The file content may still be available, but typically (and I think still the case in btrfs), the file name, permissions, and other meta data is all stored at the start of the partition.

Removing partitions (which writes to the disk) very likely has compromised the data further; when dealing with file recovery, you really never want to be writing more to the storage device you’re trying to recover from.

Filenames and structure are most likely lost at this point. Using something like photorec, you may be able to recover files that were lucky enough not to be overwritten by the Windows update you applied, but you’ll likely only be able to get them in a flat file structure, and the names will be generated names.

1 Like
12

Alright, thanks. This will take long to select them, organize them and find the downloaded pictures’ original names online and find my txt files, but I’m reinstalling openSUSE Tumbleweed. So far Tumbleweed, Fedora 40, Debian 12.6 and Linux Mint 21.3 have been the best distros I’ve tested recently. So much has improved for the Linux desktop, although the CLI and toughness of it and often times the hard work it takes to configure, and even use the system normally haven’t changed much, but once it’s set up and running well, it’s a satisfying, smooth experience. Congrats to all you devs and designers, the Linux desktop only gets better by the day, it never had so much software, so much visual appeal and the hard distros are getting easier each time. Well, some of them. Some still have workarounds that need to be done. I’ll get back to Tumbleweed asap, that was a great distro.

13 
leap15:~ # grep -m 1 -b -a -Z -o "_BHRfS_M" /dev/sda2
65600:_BHRfS_M
leap15:~ #
14

I dont have a partition to probe anymore

15

Until now we did not see anything about the partitioning as it is. We are just poking in the dark. The following commands:

lsblk -f

and as root:

fdisk -l

With comments from you about what you think is what.

It would of course be nice if you could post the same information from before the destructive actions, but I am afraid you made no notice of what your installation was.

16

Alright I’ll try those commands once I get a liveusb running

17

I would not install anything to the drive before attempting recovery. If you do, you’ll likely reduce the chances of recovering any files to zero.

If you still want to recover anything from it, consider it a read-only device until you’ve either recovered everything you think you can, or you’ve reached the point, or you feel the options are completely exhausted.

18

Screenshot from 2024-07-16 22-14-06
Screenshot from 2024-07-16 22-14-061600×900 133 KB

Ok, so I got this number
73899388:_BHRfS_M
What should I do with it?

19

Also, I think this is the partition
/dev/sda4 1763332096 1875384319 112052224 53.4G f W95 Ext’d (LBA)

20

mint@mint:~$ sudo btrfs check /dev/sda4
Opening filesystem to check…
ERROR: superblock bytenr 65536 is larger than device size 1024
ERROR: cannot open file system