Lost BTRFS Partition after system freeze - recoverable?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
sandreas
Posts: 2
Joined: 09 Mar 2025, 18:54

Lost BTRFS Partition after system freeze - recoverable?

#1 Post by sandreas »

Hello,

I use encrypted BTRFS root on my Linux Notebook (cryptsetup). Yesterday the system suddenly froze, no chance to recover the system without a hard reset. After turning it off and on, the following error occurred:

Code: Select all

No valid Btrfs found on /dev/mapper/root
ERROR: cannot open file system
Followed by an emergency shell. I did not accidentally overwrite parts of the disk nor something that produced heavy disk load. The system just crashed and killed the filesystem.

After doing some research, I tried the following commands:

Code: Select all

# still open after failed boot in emergency shell, so luksClose first to be sure
cryptsetup luksClose /dev/mapper/root
# reopen
cryptsetup luksOpen /dev/nvme0n1p1 root


btrfs check /dev/mapper/root
# No valid Btrfs found on /dev/mapper/root
# ERROR: cannot open file system

btrfs filesystem show /dev/mapper/root
# ERROR: no btrfs on /dev/dm-0

mount -t btrfs -o ro,usebackuproot /dev/mapper/root /mnt
# mount: /mnt: wrong fs type, bad option, bad superblock on /dev/mapper/root, missing codepage or helper program, or other error.

btrfs check --super 1 /dev/mapper/root
# No valid Btrfs found on /dev/mapper/root
# ERROR: cannot open file system

btrfs rescue chunk-recover /dev/mapper/root
# read super block error
# recover prepare error
# Chunk tree recovery failed

btrfs rescue super-recover -v /dev/mapper/root
# No valid Btrfs found on /dev/mapper/root
# Usage or syntax errors

btrfs rescue zero-log /dev/mapper/root
# No valid Btrfs found on /dev/mapper/root
# ERROR: could not open ctree

btrfs inspect-internal dump-tree --force /dev/mapper/root
# ERROR: device scan of /dev/mapper/root failed: Input/output error

btrfs inspect-internal dump-super /dev/mapper/root
# superblock: bytenr=65536, device=/dev/mapper/root
# --------------------------------------------------------
# ERROR: bad magic on superblock on /dev/mapper/root at 65536 (use --force to dump it anyway)

btrfs inspect-internal dump-super --force /dev/mapper/root
# this at least dumps some data

So, it seems that the partition is completely dead, except the `dump-super --force` part, which clearly shows that BTRFS Partition is in there. `smartctl` did not show any errors. I have no idea how this could have happened, any advice, e.g. using testdisk to recover the partition?

Best,

sandreas
Top
recuperation
Posts: 2975
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Lost BTRFS Partition after system freeze - recoverable?

#2 Post by recuperation »

Run TestDisk from a pen drive and post your TestDisk log file.
Your luks encryption should provide you with a virtual disk or partition that contains the decrypted content.
Run TestDisk against this device.
Top
sandreas
Posts: 2
Joined: 09 Mar 2025, 18:54

Re: Lost BTRFS Partition after system freeze - recoverable?

#3 Post by sandreas »

Thank you for the quick response.



So I tried to analyze the disks and create logs, but somehow it seems strange. I attached the logs I created but do you have any advice regarding which commands to use?

Code: Select all

./testdisk_static /log /dev/sdb
./testdisk_static /log /dev/mapper/....
Here are the logs:

LUKS: https://pilabor.com/testdisk_luks.log

Mapper: https://pilabor.com/testdisk_mapper.log

If I did anything wrong, feel free to give further instructions.
Top
recuperation
Posts: 2975
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Lost BTRFS Partition after system freeze - recoverable?

#4 Post by recuperation »

It appears that TestDisk did not find any valid BTRFS boot sector when you were running
TestDisk against the block device named luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4.
As there are no special features available in TestDisk for BTRFS, try out other recovery software that claim BTRFS support.
Before doing so clone that unencrypted virtual device to another block device or file.
I recommend using ddrescue as described in the manual (can be interrupted and continued) regardless of your statement that you had no SMART errors.
Use this clone or file with other recovery software.
If that fails, use PhotoRec on the clone.

Code: Select all

Using locale 'de_DE.UTF-8'.


Wed Mar 12 09:45:06 2025
Command line: TestDisk /log /dev/sdb

TestDisk 7.3-WIP, Data Recovery Utility, September 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.12.18-1-lts (#1 SMP PREEMPT_DYNAMIC Fri, 07 Mar 2025 18:50:18 +0000) x86_64
Compiler: GCC 14.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20120504, curses lib: ncurses 6.4
Hard disk list
Disk /dev/sdb - 2048 GB / 1907 GiB - CHS 249038 255 63, sector size=512 - RTL9210B-CG, FW:1.00

Partition table type (auto): EFI GPT
Disk /dev/sdb - 2048 GB / 1907 GiB - RTL9210B-CG
Partition table type: None

Interface Advanced
   P Unknown                  0   0  1 249038  29 63 4000797360
Change partition type:
   P Linux LUKS               0   0  1 249038  29 63 4000797360

Analyse Disk /dev/sdb - 2048 GB / 1907 GiB - CHS 249038 255 63
Current partition structure:
   P Unknown                  0   0  1 249038  29 63 4000797360

search_part()
Disk /dev/sdb - 2048 GB / 1907 GiB - CHS 249038 255 63
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used
FAT: cluster=2(0x2), pos=6176
     FAT32                    0  32 33   130 170 40    2097152 [EFI System Partition] [NO NAME]
     FAT32, blocksize=4096, 1073 MB / 1024 MiB
     Linux LUKS             130 170 41 178801  17 50 2870339986
     LUKS 2 (Data size unknown), 1469 GB / 1368 GiB

interface_write()
   P FAT32                    0  32 33   130 170 40    2097152 [EFI System Partition] [NO NAME]
   P Linux LUKS             130 170 41 178801  17 50 2870339986
 
Write isn't available because the partition table type "None" has been selected.

TestDisk exited normally.

Code: Select all

Using locale 'de_DE.UTF-8'.


Wed Mar 12 10:24:44 2025
Command line: TestDisk /log /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4

TestDisk 7.3-WIP, Data Recovery Utility, September 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.12.18-1-lts (#1 SMP PREEMPT_DYNAMIC Fri, 07 Mar 2025 18:50:18 +0000) x86_64
Compiler: GCC 14.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20120504, curses lib: ncurses 6.4
Hard disk list
Disk /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4 - 2047 GB / 1906 GiB - 3998663344 sectors, sector size=512

Partition table type defaults to Intel
Disk /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4 - 2047 GB / 1906 GiB
Partition table type: Intel

Analyse Disk /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4 - 2047 GB / 1906 GiB - 3998663344 sectors
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4 - 2047 GB / 1906 GiB - 3998663344 sectors
BAD_RS LBA=1284304443 296
check_part_i386 failed for partition type 04
     FAT16 <32M            1284304443 5405469403 4121164961
This partition ends after the disk limits.
     HFS                      1325850  688536347  687210498
     HFS blocksize=33554432, 351 GB / 327 GiB
BAD_RS LBA=2864861201 194
check_part_i386 failed for partition type 01
     FAT12                 2864861201 2878868827   14007627
BAD_RS LBA=4912640525 765
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA             4912640525 7424694381 2512053857
This partition ends after the disk limits.
BAD_RS LBA=3012083454 684
check_part_i386 failed for partition type 04
     FAT16 <32M            3012083454 7061650520 4049567067
This partition ends after the disk limits.
BAD_RS LBA=4899200984 566
check_part_i386 failed for partition type 07
     HPFS - NTFS           4899200984 8877791243 3978590260
This partition ends after the disk limits.
BAD_RS LBA=5505830617 303
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA             5505830617 6108222863  602392247
This partition ends after the disk limits.
BAD_RS LBA=6253422204 1067
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA             6253422204 8427538031 2174115828
This partition ends after the disk limits.
SIGINT detected! PhotoRec has been killed.
SIGINT detected! PhotoRec has been killed.
Using locale 'de_DE.UTF-8'.


Wed Mar 12 10:25:59 2025
Command line: TestDisk /log /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4

TestDisk 7.3-WIP, Data Recovery Utility, September 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.12.18-1-lts (#1 SMP PREEMPT_DYNAMIC Fri, 07 Mar 2025 18:50:18 +0000) x86_64
Compiler: GCC 14.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20120504, curses lib: ncurses 6.4
Hard disk list
Disk /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4 - 2047 GB / 1906 GiB - 3998663344 sectors, sector size=512

Partition table type defaults to Intel
Disk /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4 - 2047 GB / 1906 GiB
Partition table type: None

Interface Advanced
   P Unknown                        0 3998663343 3998663344
Change partition type:
   P btrfs                          0 3998663343 3998663344

Interface Advanced
   P Unknown                        0 3998663343 3998663344
Change partition type:
   P btrfs                          0 3998663343 3998663344

Analyse Disk /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4 - 2047 GB / 1906 GiB - 3998663344 sectors
Current partition structure:
   P Unknown                        0 3998663343 3998663344

search_part()
Disk /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4 - 2047 GB / 1906 GiB - 3998663344 sectors
     HFS                      1325850  688536347  687210498
     HFS blocksize=33554432, 351 GB / 327 GiB
check_FAT: Bad jump in FAT partition
     WBFS                  1165776088 35861397539411159 35861396373635072
     WBFS, 18361034 TB / 16699264 TiB
This partition ends after the disk limits.
     WBFS                  1249136112 18014399758618095 18014398509481984
     WBFS, 9223372 TB / 8388608 TiB
This partition ends after the disk limits.
     Sys=0D                1766194058 2548632426  782438369
     FATX, 400 GB / 373 GiB
     CramFS                2643293344 2647397394    4104050 [CbàœUÇQê±ÔƼ	Þ]
     cramfs, 2101 MB / 2003 MiB
     SysV 4                2858273227 2858273226          0 [XŒ¿	R>]
     SysV4, 0 B
     SysV 4                3219543979 7126125430 3906581452 [<Ü h¬]
     SysV4, 2000 GB / 1862 GiB
This partition ends after the disk limits.
     SysV 4                3471484831 11123416623006 11119945138176 [ËÔf]
     SysV4, 5693 TB / 5178 TiB
This partition ends after the disk limits.
check_FAT: Bad number of sectors per cluster
Disk /dev/mapper/luks-c371f9c5-7457-4cc4-8e8d-9432aa1187a4 - 2047 GB / 1906 GiB - 3998663344 sectors
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (2047 GB / 1906 GiB) seems too small! (< 18361035 TB / 16699264 TiB)
The following partitions can't be recovered:
     WBFS                  1165776088 35861397539411159 35861396373635072
     WBFS, 18361034 TB / 16699264 TiB
     WBFS                  1249136112 18014399758618095 18014398509481984
     WBFS, 9223372 TB / 8388608 TiB
     SysV 4                3219543979 7126125430 3906581452 [<Ü h¬]
     SysV4, 2000 GB / 1862 GiB
     SysV 4                3471484831 11123416623006 11119945138176 [ËÔf]
     SysV4, 5693 TB / 5178 TiB
SIGINT detected! PhotoRec has been killed.
SIGINT detected! PhotoRec has been killed.
Top
Post Reply

Return to “Partition Recovery”