Simple ZFS(1 disk, 1 partition, no encryption) partition recovery Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
light
Posts: 2
Joined: 02 Apr 2021, 00:38

Simple ZFS(1 disk, 1 partition, no encryption) partition recovery

#1 Post by light »

So, a day back, I was setting up a new disk using ZFS. The Linux system I was setting it up on had multiple disks attached to it. I passed through the block devices to two of the disks on a FreeBSD vm(I wanted to format and copy data from one disk to the other).

When it came to formatting the disks, I mistakenly used the name of the disk with the data instead of the one without it. The following command was used:

Code: Select all

gpart destroy -F vbbr1

When I realised my mistake it was too late and I had turned off the VM. But the underlying Linux system is still running. I installed and ran testdisk but it did not find the zfs partitions as far as I can tell:
https://pastebin.com/FSieVV4Z

I looked at the block device in hexedit and I can see that the data is still there:
https://pastebin.com/raw/eaikzYyp
https://pastebin.com/raw/HFf3ABQh

The partition was originally created in Linux(just one disk) using:

Code: Select all

sudo zpool create new-pool /dev/sdb

Can I get the partition information from some Linux cache since I didnt restart? If not, is there a way to restore the data. Its there according to hexedit.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Simple ZFS(1 disk, 1 partition, no encryption) partition recovery

#2 Post by recuperation »

There is no support for ZFS as you can read here:

https://www.cgsecurity.org/

You can try to add this partition manually if you already know its location.
You can reach this feature by clicking on Proceed/Analyse/Quick search/Stop/add partition.

To minimize risk you should either duplicate your disk or at least the beginning and the end where the GPT is located to be able to revert your actions.

Please upload your pictures using the attachment tab on the bottom of the page. It will become visible once you edit your posting.

light
Posts: 2
Joined: 02 Apr 2021, 00:38

Re: Simple ZFS(1 disk, 1 partition, no encryption) partition recovery

#3 Post by light »

Got it fixed!

I wanted to create a seperate write volume for a qcow backed with the corrupted disk. For some reason that doesnt work with qemu and virtualbox was showing all zeros if I did that. So, I created an image of the first 8gb of the device using dd and mounted that on a vm and played around with it using sgdisk until zfs started recognizing it.
Then I used the starting value I figured out plus the ending value was just the maximum allowed(this obviously wouldnt work if there was more than one partition). So, in the end it all worked out.
Lesson learned. keep a backup of the partition table as well as the important data.

I learned a lot about partition tables and how data is stored in the disks hands-on so it wasn't all a bad experience overall. :D

Locked