BTRFS Recover deleted files without snapshot

Question

I deleted all the files on a /dev/sdb1 4TB disk. This was done with the rsync --delete command.

Before being stopped the rsync wrote about 10GB of data.

Of course there is no snapshot on the disk.

The btrfs filesystem was mounted to the /home/user/Downloads folder.

So I wanted to know if there was a way to restore the data.

So far (after unmounting my disk) I've tried :

• btrfs restore :

btrfs restore -i /dev/sdb1 /mnt/RESTORE/

Which only restored the 10GB new files.

• The btrfs-undelete script which I manage to make it work : ./btrfs.sh /dev/sdb1 /home/user/Downloads/* /mnt/RESTORE/

Result :

[...]
Trying root 3001138823168... (1096/1103)
Trying root 853360640... (1097/1103)
Trying root 50626560... (1098/1103)
Trying root 31309824... (1099/1103)
Trying root 31129600... (1100/1103)
Trying root 30900224... (1101/1103)
Trying root 30818304... (1102/1103)
Trying root 30408704... (1103/1103)
Didn't find 'home/user/D*/*

• I also tried to manually restore file with btrfs restore -t 3001556484096 /dev/sdb1 /mnt/RESTORE/ :

parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
Ignoring transid failure
ERROR: root [1 0] level 0 does not match 1

Couldn't read tree root
Could not open root, trying backup super
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
Ignoring transid failure
ERROR: root [1 0] level 0 does not match 1

Couldn't read tree root
Could not open root, trying backup super
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
parent transid verify failed on 3001556484096 wanted 96918 found 96231
Ignoring transid failure
ERROR: root [1 0] level 0 does not match 1

Couldn't read tree root
Could not open root, trying backup super

• btrfs-find-root -a /dev/sdb1 output :

Superblock thinks the generation is 96918
Superblock thinks the level is 1
[...]
Well block 3001381945344(gen: 94646 level: 0) seems good, but generation/level doesn't match, want gen: 96918 level: 1
Well block 3001359089664(gen: 94635 level: 0) seems good, but generation/level doesn't match, want gen: 96918 level: 1
Well block 853360640(gen: 94238 level: 0) seems good, but generation/level doesn't match, want gen: 96918 level: 1

• btrfs rescue super-recover -v /dev/sdb1 output :

All Devices:
        Device: id = 1, name = /dev/sdb1

Before Recovering:
        [All good supers]:
                device name = /dev/sdb1
                superblock bytenr = 65536

                device name = /dev/sdb1
                superblock bytenr = 67108864

                device name = /dev/sdb1
                superblock bytenr = 274877906944

        [All bad supers]:

All supers are valid, no need to recover

So any help will be appreciated :)

Update 1 :

Unfortunately, I was able to restore only few corrupted files. Here what I've done following the btrfs-undelete script.

• Get every ID to a /tmp/ID file :

btrfs-find-root -a /dev/sdb1 2>&1 | grep ^Well | sed -r -e 's/Well block ([0-9]+).*/\1/' | sort -rn > /tmp/ID

• Restore everything I can from ID :

for i in $(cat /tmp/ID) ; do mkdir /mnt/RESTORE/"$i"; btrfs restore -o -iv -t "$i" /dev/sdb1 /mnt/RESTORE/"$i" 2>&1; done

I guess now the only way is to find a files recovery software...

Answer 1

As discussed earlier I finally used a file recovery software. I tried EaseUS Data Recovery Wizard and UFS Explorer Standard Recovery v9.13 because both are supposed to be compatible with btrfs.

We can try both software for free (only the scan is available in this mode which allows us to see if we can recover something).

In my experience UFS Explorer was the better solution. Indeed after a scan it was able to list the deleted files with the original names and directory tree.

EaseUS Data Recovery Wizard was able to recover files, but most of them were not properly named and it didn't respect the original directory organization.

So, for me the best solution was UFS Explorer Standard Recovery. It costs about 70$ for personnal licence :

https://www.ufsexplorer.com/ufs-explorer-standard-recovery/