Recover a ufs2 filesystem from a reformat with another ufs2 filesystem

[Anders Andersson]

Dear list! I realized that I never replied with a follow-up to this
problem I had, and even though a long time have passed I want to
explain what I did so that others in a similar situation can read
about it.


On Mon, Feb 14, 2011 at 1:35 AM, Ivan Voras <ivoras at freebsd.org> wrote:
> On 13/02/2011 21:39, Anders Andersson wrote:
>
>> 1) If an old file system is overwritten by a new file system with the
>> same size, are there any traces of the old file system meta data left?
>> I'm thinking randomized backup headers scattered throughout the file
>> system, which would have a different location after each new format.
>
> No, not randomized at all, unfortunately for your purpose - there are copies
> of superblocks, but all important data is on precisely deterministic
> positions for somewhat the same reasons - to help recovery in case parts of
> it are missing.

Perhaps it would be beneficial if some of this information was spread
out at random for recover purpose, although I don't know what bad side
effects this would create.



>> 4) If everything else fails, can you recommend a good overview about
>> UFS2, how and where the bits and pieces are stored on disk?
>
> That would be a very complicated but also very interesting way to learn in
> extreme details about a file system :)

The more you learn, the better. :) I never went to this length though.
I ended up just using photorec/magicrescue on the block device to find
at least some photos and documents.



> In any case, as others said, DO NOT WORK ON THE "LIVE" HARD DRIVE. Make a
> copy image of it.

Naturally. Though I had to do some extra trickery here since I didn't
have 2TB spare to take a full backup. What I did was to use the device
mapper subsystem in linux to create writable snapshots over the
read-only master. Having multiple writable snapshots is handy when
comparing things.