cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

The hard disk seems too small (Btrfs)

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=12330

Page 1 of 1

The hard disk seems too small (Btrfs)

Posted: 23 Apr 2023, 05:48
by dfcamara
After installing Linux (Fedora 38) I inadvertently deleted the partition table of my second disk (NVMe). This disk contains one partition formatted with Btrfs using all the disk space.

Running TestDisk 7.2-WIP (as root) I was able to find the partition. The partition size almost matches the disk size, although it starts at sector 130944 and ends after the last disk sector.

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, March 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32

The hard disk (2000 GB / 1863 GiB) seems too small! (< 2000 GB / 1863 GiB)
Check the hard disk size: HD jumper settings, BIOS detection...

The following partition can't be recovered:
     Partition               Start        End    Size in sectors
>  Linux filesys. data       130944 3907160111 3907029168 [achernar_data]

[ Continue ]
btrfs blocksize=4096, 2000 GB / 1863 GiB
testdisk.log

Code: Select all

Sat Apr 22 20:37:31 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, March 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.2.11-300.fc38.x86_64 (#1 SMP PREEMPT_DYNAMIC Thu Apr 13 20:27:09 UTC 2023) x86_64
Compiler: GCC 4.8
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/nvme0n1 - 1000 GB / 931 GiB - CHS 953869 64 32, sector size=512
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB
Partition table type: EFI GPT

Analyse Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907162111 (expected 3907029167)
hdr_lba_start=34
hdr_lba_end=3907162078
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P Linux filesys. data       130944 3907160111 3907029168

search_part()
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32

recover_btrfs: part_size 3907029168
     Linux filesys. data       130944 3907160111 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=130944, size=3907029168, end=3907160111, disk end=3907029168)
Search for partition aborted
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (2000 GB / 1863 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
     Linux filesys. data       130944 3907160111 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

TestDisk exited normally.
Following the instructions in viewtopic.php?t=8144 I tried to change the Geometry to increase the numbers of cylinders from 1907729 to 1907794. It seemed to work but in the end I got the error "Partition: Write error"

Code: Select all

Sun Apr 23 00:56:12 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, March 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.2.11-300.fc38.x86_64 (#1 SMP PREEMPT_DYNAMIC Thu Apr 13 20:27:09 UTC 2023) x86_64
Compiler: GCC 4.8
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       3907029168 sectors
/dev/sda: user_max   3907029168 sectors
/dev/sda: native_max 3907029168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-1ER164, S/N:Z4Z3LN41, FW:CC26
Disk /dev/nvme0n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32, sector size=512
Disk /dev/nvme1n1 - 1000 GB / 931 GiB - CHS 953869 64 32, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/nvme0n1 - 2000 GB / 1863 GiB
Partition table type: EFI GPT
New geometry
Disk /dev/nvme0n1 - 2000 GB / 1863 GiB - CHS 1907794 64 32 sector_size=512

Analyse Disk /dev/nvme0n1 - 2000 GB / 1863 GiB - CHS 1907794 64 32
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907160063 (expected 3907162111)
hdr_lba_start=34
hdr_lba_end=3907160030
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P Linux filesys. data       130944 3907160111 3907029168

search_part()
Disk /dev/nvme0n1 - 2000 GB / 1863 GiB - CHS 1907794 64 32

recover_btrfs: part_size 3907029168
     Linux filesys. data       130944 3907160111 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

Results
   P Linux filesys. data       130944 3907160111 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 3907029168 linear /dev/nvme0n1 130944" | dmsetup create test0

interface_write()
 1 P Linux filesys. data       130944 3907160111 3907029168 [achernar_data]

search_part()
Disk /dev/nvme0n1 - 2000 GB / 1863 GiB - CHS 1907794 64 32

recover_btrfs: part_size 3907029168
     Linux filesys. data       130944 3907160111 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

       0 0000 0000 00 00 00 00 00 00 00 00
     Unknown                 23598180 34848173560931 34848149962752
     WBFS, 17842 TB / 16227 TiB
       0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

LVM magic value at 18608/61/3

recover_btrfs: part_size 3907029168
     Linux filesys. data    536870784 4443899951 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=536870784, size=3907029168, end=4443899951, disk end=3907162112)
Search for partition aborted
Disk /dev/nvme0n1 - 2000 GB / 1863 GiB - CHS 1907794 64 32
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (2000 GB / 1863 GiB) seems too small! (< 2275 GB / 2119 GiB)
The following partition can't be recovered:
     Linux filesys. data    536870784 4443899951 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

Results
   P Linux filesys. data       130944 3907160111 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 3907029168 linear /dev/nvme0n1 130944" | dmsetup create test0
gpt_change_part_type
Change partition type:
   P Linux filesys. data       130944 3907160111 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB
Change partition type:
   P btrfs                     130944 3907160111 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

interface_write()
 1 P Linux filesys. data       130944 3907160111 3907029168 [achernar_data]
write!
file_pwrite(5,32,buffer,3907162079(1907793/62/32)) write err No space left on device

Partition: Write error

TestDisk exited normally.

Re: The hard disk seems too small (Btrfs)

Posted: 23 Apr 2023, 09:48
by dfcamara
In case it's useful, this is my annotation when I originally created the partition:

Code: Select all

lsblk

    NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
    nvme1n1     259:0    0   1.8T  0 disk 

sudo mkfs.btrfs -L achernar_data /dev/nvme1n1

    btrfs-progs v5.16.2
    See http://btrfs.wiki.kernel.org for more information.

    Performing full device TRIM /dev/nvme1n1 (1.82TiB) ...
    NOTE: several default settings have changed in version 5.15, please make sure
          this does not affect your deployments:
          - DUP for metadata (-m dup)
          - enabled no-holes (-O no-holes)
          - enabled free-space-tree (-R free-space-tree)

    Label:              achernar_data
    UUID:               d5d5a41e-913a-4552-b7c7-4f33c5a3fbdb
    Node size:          16384
    Sector size:        4096
    Filesystem size:    1.82TiB
    Block group profiles:
      Data:             single            8.00MiB
      Metadata:         DUP               1.00GiB
      System:           DUP               8.00MiB
    SSD detected:       yes
    Zoned device:       no
    Incompat features:  extref, skinny-metadata, no-holes
    Runtime features:   free-space-tree
    Checksum:           crc32c
    Number of devices:  1
    Devices:
       ID        SIZE  PATH
        1     1.82TiB  /dev/nvme1n1

Re: The hard disk seems too small (Btrfs)

Posted: 24 Apr 2023, 15:17
by recuperation
Your log file states data that does not fit together:

> This partition ends after the disk limits. (start=130944, size=3907029168, end=3907160111, disk end=3907029168)

start 130.944
size 3.907.029.168
end 3.907.160.111
disk end 3.907.029.168

The partition found has as many sectors as your disk has.
That can suggest that your partition begins at sector 0. This kind of setup is not common.

Given start and size of the partition, the partition ends at sector 3.907.160.111 which is beyond the last sector of the disk which is 3.907.029.168 minus one (counting LBA numbers where the first sector is carrying the number zero).

The operation of your operating system does not depend on drive geommetry information that you tried to change.
When in GPT mode, Testdisk has to write the backup GPT table at the end of the disk. This is impossible because that end is used up by your partition.

Please duplicate your drive.
You can try out if you can write a partition table in MBR mode as this mode does not require writing a table at the end of the disk.
Afterwards you can mount your partition in read-only mode. If the content of that BTRFS partition can be read you can duplicate the content of your BTRFS partition file-wise to another disk.

Re: The hard disk seems too small (Btrfs)

Posted: 24 Apr 2023, 15:19
by dfcamara
Because the size of my partition equal the size of the disk, I'm considering the possibility that I may have actually ended up formatting the disk with Disks (gnome-disk-utility) and creating one partition with the hole disk (without a partition table).

Running TestDisk and selecting partition type None I got again the message "The hard disk seems too small":

Code: Select all

Mon Apr 24 10:52:32 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, March 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.2.11-300.fc38.x86_64 (#1 SMP PREEMPT_DYNAMIC Thu Apr 13 20:27:09 UTC 2023) x86_64
Compiler: GCC 4.8
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
/dev/sda: LBA, HPA, LBA48 support
/dev/sda: size       234441648 sectors
/dev/sda: user_max   234441648 sectors
/dev/sda: native_max 234441648 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - CT120BX500SSD1, S/N:2004E3E5B22B, FW:M6CR013
Disk /dev/nvme0n1 - 1000 GB / 931 GiB - CHS 953869 64 32, sector size=512
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB
Partition table type: None

Interface Advanced
   P Unknown                  0   0  1 1907729   5 16 3907029168
Change partition type:
   P btrfs                    0   0  1 1907729   5 16 3907029168

Analyse Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32
Current partition structure:
   P Unknown                  0   0  1 1907729   5 16 3907029168

search_part()
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32

recover_btrfs: part_size 3907029168
     btrfs                   63  60  1 1907793   1 16 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=130944, size=3907029168, end=3907160111, disk end=3907029168)
Search for partition aborted
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (2000 GB / 1863 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
     btrfs                   63  60  1 1907793   1 16 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

Results

interface_write()
 
No partition found or selected for recovery

TestDisk exited normally.
Trying again to change the geometry to 1907793 I end up with the message "Write isn't available because the partition table type None has been selected.":

Code: Select all

Mon Apr 24 11:03:04 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, March 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.2.11-300.fc38.x86_64 (#1 SMP PREEMPT_DYNAMIC Thu Apr 13 20:27:09 UTC 2023) x86_64
Compiler: GCC 4.8
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
/dev/sda: LBA, HPA, LBA48 support
/dev/sda: size       234441648 sectors
/dev/sda: user_max   234441648 sectors
/dev/sda: native_max 234441648 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - CT120BX500SSD1, S/N:2004E3E5B22B, FW:M6CR013
Disk /dev/nvme0n1 - 1000 GB / 931 GiB - CHS 953869 64 32, sector size=512
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907729 64 32, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB
Partition table type: None

Interface Advanced
   P Unknown                  0   0  1 1907729   5 16 3907029168
Change partition type:
   P btrfs                    0   0  1 1907729   5 16 3907029168
New geometry
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907793 64 32 sector_size=512

Analyse Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907793 64 32
Current partition structure:
   P Unknown                  0   0  1 1907792  63 32 3907160064

search_part()
Disk /dev/nvme1n1 - 2000 GB / 1863 GiB - CHS 1907793 64 32

recover_btrfs: part_size 3907029168
     btrfs                   63  60  1 1907793   1 16 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

Results
   P btrfs                   63  60  1 1907793   1 16 3907029168 [achernar_data]
     btrfs blocksize=4096, 2000 GB / 1863 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 3907029168 linear /dev/nvme1n1 130944" | dmsetup create test0

interface_write()
   P btrfs                   63  60  1 1907793   1 16 3907029168 [achernar_data]
 
Write isn't available because the partition table type "None" has been selected.

TestDisk exited normally.

Re: The hard disk seems too small (Btrfs)

Posted: 12 May 2023, 22:13
by dfcamara
I was able to recover my disk (all file data and metadata) using btrfs-select-super utility to overwrite the primary superblock with a backup copy. As I thought, my disk originally didn't contain a partition table.

Code: Select all

sudo btrfs-select-super -s 2 /dev/nvme1n1

Re: The hard disk seems too small (Btrfs)

Posted: 13 May 2023, 14:08
by recuperation
Thank you for reporting your solution!
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited