Find ZFS partition Topic is solved

[arm512]

At last! I've found it!
1. search for "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 7a 0c b1 7a da 10 02"
2. in data we found, search for "name $ZPOOL_NAME".
3. "11 7a 0c b1 7a da 10 02" should start at 16344 offset (decimal)
4. Offset we need: LOOP_OFFSET = $OFFSET_OF_THE_11 — 16344 (decimal)
5.

Code: Select all

losetup -o $LOOP_OFFSET -f /dev/$YOUR_DEVICE

6.

Code: Select all

zpool import
    pool: u
     id: 12365036168641488822
  state: ONLINE
 status: The pool was last accessed by another system.
 action: The pool can be imported using its name or numeric identifier and
	the '-f' flag.
   see: http://zfsonlinux.org/msg/ZFS-8000-EY
 config:

	u           ONLINE
	  loop11    ONLINE

Then we can import it read-only and zfs-send->zfs-recv, then scrub and sure that all data is OK.

[arm512]

Support for ZFS in TestDisk is very limited.
TestDisk should be able to find ZFS boot block (struct vdev_boot_header) https://git.cgsecurity.org/cgit/testdisk/tree/src/zfs.c
The beginning of a partition may looks like (hexdump output)

Code: Select all

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00003fd0  00 00 00 00 00 00 00 00  11 7a 0c b1 7a da 10 02  |.........z..z...|
                                   zio-data-bloc-tail
...

Thank you again! I found my data.
But, I'd like Testdisk to make this instead of me. Can my issue be a reason to make some little changes in code for Testdisk could do this work? How can I help (I'm not a coder, just a system administrator/DevOps)?
I think there is a difference between creating pool on whole disk and on partition. In the whole-disk case zpool creates GPT by it's own, with partition 9, and so on, like Solaris does. And on the loop device zpool behaves like with partition, not like with real hdd/ssd.
I can play with all OS'es supporting ZFS and different configuration (whole disk, partition, raidz...) and send results to you.