# btrfs-question. Recover data after btrfs.mkfs

## ratten

Hey People,

I have a Question regarding btrfs. 

I had a previously btrfs-formatted partition with data and thought i do not need it anymore so i did a btrfs.mkfs on it.

Well, it turned out that i still need some data from that partition.

Is it possible to still recover the previous data from that partition despite my btrfs.mkfs on the partition?

The partition was not changed in size only a fresh btrfs.mkfs. Also no data was added to the filesystem after the btrfs.mkfs

The command "btrfs-find-root" seems to hang:	

# btrfs-find-root -a /dev/sda4

Superblock thinks the generation is 11

Superblock thinks the level is 0	

Is it possible to recover data or maybe even the whole datasystemstructure from the previous btrfs-filesystem?

----------

## DawgG

if you are very lucky, you might find sth. with btrfs-recover or btrfs-rescue, but i do not think so because your fresh filesystem is not damaged; i.e. the working structures of the old fs have been replaced with working structures of the new (empty) fs.

depending on the size you should create an image with dd or ddrescue and try to recover the data from that that with testdisk/photorec or sth similar. this (probably) works but is no fun because it only recovers the files but not the filenames.

GOOD LUCK!

----------

## yilmi

You can try testdisk, it is used by forensics professionals and it is licensed under GPL  :Wink: 

see http://www.cgsecurity.org/wiki/TestDisk

----------

## The_Great_Sephiroth

I was also going to recommend testdisk, but if the data structures in BTRFS are re-written then even if the data is still there (I did not see you mention wiping the disk, so chances are the data itself IS there) it may be hard to recognize it.

----------

## NeddySeagoon

ratten,

The normal way to find your data it a flesystem is to traverse the directory tree starting with the root directory.

The root directory is gone.  Making a new filesystem made a new root directory.

It also marked all the space in the filesystem as free. This is all generic filesystem stuff.

If this is on an SSD, all the space will have been discarded at filesystem make time too, so the SSD will be doing block erases in its own time.

Its likely that all the data and subdirectories below the root filesystem are still there.

Depending on what and where btrfs stores metadata, that may or may not be enough to get started picking at file fragments.

How desperate are you to recover files?

```
emerge sleuthkit 
```

and poke about.  I'm not sure if it supports btrfs.  Its a forensics toolkit.

If you can find a subdirectory, you may be able to copy the files out and navigate to other directories.

Its not an easy tool to use, you will likely need to spend a lot of your free time with sleuthkit.

----------

## ratten

Oki, i understand...root tree is gone...well, i thought maybe btrfs offers an option...

Thanks for the explanation.

I have now recovered with TestDisk(THX @yilmi) what TestDisk could find and trying to make sense of the Files..they are not recovered under their original name so...it's a mess...

Will give sleuthkit a chance too...

Thanks @all for looking into it...

----------

## antonakabug

btrfs-progs version  4.3.1 helped to me.

btrfs-find-root -a not hang

All greater version hanged for me.

----------

