Search found 8 matches

by arm512
15 Nov 2020, 22:56
Forum: Partition Recovery
Topic: Find ZFS partition
Replies: 11
Views: 8795

Re: Find ZFS partition


Support for ZFS in TestDisk is very limited.
TestDisk should be able to find ZFS boot block (struct vdev_boot_header) https://git.cgsecurity.org/cgit/testdisk/tree/src/zfs.c
The beginning of a partition may looks like (hexdump output)

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...
by arm512
15 Nov 2020, 22:38
Forum: Partition Recovery
Topic: Find ZFS partition
Replies: 11
Views: 8795

Re: Find ZFS partition

At last! I've found it!
1. search for "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 7a 0c b1 7a da 10 02"
2. in data we found, search for "name $ZPOOL_NAME".
3. "11 7a 0c b1 7a da 10 02" should start at 16344 offset (decimal)
4. Offset we need: LOOP_OFFSET = $OFFSET_OF ...
by arm512
15 Nov 2020, 15:45
Forum: Partition Recovery
Topic: Find ZFS partition
Replies: 11
Views: 8795

Re: Find ZFS partition

Searching "11 7a 0c b1 7a da 10 02" was not the best idea. After find-counter turned to 8500, I decided to search "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 7a 0c b1 7a da 10 02" instead.
We'll see what will give.
by arm512
15 Nov 2020, 15:11
Forum: Partition Recovery
Topic: Find ZFS partition
Replies: 11
Views: 8795

Re: Find ZFS partition



And in his case, ZFS is detected, but noone of my ZFS partitions, both lost and healthy, is visible forTestdisk. Why so?

If your children are kidnapped they are kind of lost but you can never say they are healthy.
The same applies to your ZFS partitions. There is no evidence that they are ...
by arm512
15 Nov 2020, 12:42
Forum: Partition Recovery
Topic: Find ZFS partition
Replies: 11
Views: 8795

Re: Find ZFS partition

Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63

Partition Start End Size in sectors
1 P Linux filesys. data 40 4095 4056 [Linux filesystem]
2 P MS Data 4096 2101247 2097152 [T3.D2.E1]
3 P MS Data 2101248 1259382783 1257281536 [Win10]
4 P Linux filesys. data 1259382784 1263609855 ...
by arm512
15 Nov 2020, 12:36
Forum: Partition Recovery
Topic: Find ZFS partition
Replies: 11
Views: 8795

Re: Find ZFS partition


Support for ZFS in TestDisk is very limited.
TestDisk should be able to find ZFS boot block (struct vdev_boot_header) https://git.cgsecurity.org/cgit/testdisk/tree/src/zfs.c
The beginning of a partition may looks like (hexdump output)

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...
by arm512
15 Nov 2020, 12:34
Forum: Partition Recovery
Topic: Find ZFS partition
Replies: 11
Views: 8795

Re: Find ZFS partition

recuperation wrote: 15 Nov 2020, 09:14 Have the ZFS partitions been encrypted?
Neither LUKS nor plain. May be ZFS native encryption, but no third-party soft.
by arm512
14 Nov 2020, 21:43
Forum: Partition Recovery
Topic: Find ZFS partition
Replies: 11
Views: 8795

Find ZFS partition

Hello, I've mistakenly destroyed GPT on HDD. (Yes, both main and backup GPT.)
Here: https://www.cgsecurity.org/wiki/TestDisk is said that Testdisk can find lost ZFS partitions.
Testdisk recovered all partition, except 2 non-raid ZFS pools.
It sees even raw partitions, I've backuped in files and raw ...