Recover a ufs2 filesystem from a reformat with another ufs2 filesystem

[Alexander Best]

On Sun Feb 13 11, Anders Andersson wrote:
> Hi! I'm sorry if this has been brought up already but the search
> function in the archives seem to be broken (since 2007?) so I couldn't
> search for duplicates.
> 
> A short summary of my problem: I am trying to recover files from a
> UFS2 file system that has been overwritten by a new UFS2 file system.
> 
> A longer problem description: I'm trying to help a friend recover from
> a somewhat stupid mistake. He used a specialised distribution based on
> FreeBSD (FreeNAS), that among other things can manage harddrives and
> file systems. For reasons that he doesn't know, this tool formatted
> his old partition with a new UFS2 file system when he attached it,
> even though there was a perfectly fine one on the disk already. Now
> I'm trying to recover the files from the old one, but a problem is
> that the old one was also a UFS2 file system, so the tools I have
> tried only finds the new one.
> 
> Now, being a linux guy with (unfortunately) very little experience of
> any of the BSDs, I am trying this out in linux with the tools I have,
> but it's not very easy. I don't know anything about UFS2 so I have
> some questions:
> 
> 1) If an old file system is overwritten by a new file system with the
> same size, are there any traces of the old file system meta data left?
> I'm thinking randomized backup headers scattered throughout the file
> system, which would have a different location after each new format.
> 2) If there are no traces left of the old file system, would there be
> any UFS2-aware recovery programs that could scan the disk and try to
> regenerate the necessary meta data from, say, partition size, file
> offsets, some other magic...?
> 3) Are there any powerful tools availaible for tasks like this in
> FreeBSD that are not ported to Linux? In that case, I could easily
> install FreeBSD in a virtual machine and salvage the files there.
> 4) If everything else fails, can you recommend a good overview about
> UFS2, how and where the bits and pieces are stored on disk?

i'm no expert, but the very first thing your friend should do probably is

1) boot from a freebsd bootable dvd / memstick

2) dd if=/dev/overwritten_hdd of=/file/on_another_huge_hdd bs=1m

3) physically disconnect the overwritten hdd and do all further experiments
   via mdconfig(1).

good luck.
alex

> 
> Anything helps!
> 
> // Anders

-- 
a13x