ZFS help to get data from ssd

Hi, I've attached my ssd to linux host and tryed to mount partition, but instead i created new pool and now its impossible to load from this ssd, how can i just 'mount /dev/ada1p3 /home' and retrieve data from it, I hope that anything was not deleted and its possible to pull data from it.

Thanks
 
Hi, I've attached my ssd to linux host and tryed to mount partition, but instead i created new pool and now its impossible to load from this ssd, how can i just 'mount /dev/ada1p3 /home' and retrieve data from it, I hope that anything was not deleted and its possible to pull data from it.

Thanks
For now i loaded from an old hdd with my first freebsd installation and attached this rewriten pool1 ssd, it was actually a zroot one before ive tried to access it from linux
 
If you create a pool in your ssd, you shouldn't mount, you have to import the pool by zpool import <poolname>.
Same for linux, you have to import the pool in the same way in both OS.
 
If you create a pool in your ssd, you shouldn't mount, you have to import the pool by zpool import <poolname>.
Same for linux, you have to import the pool in the same way in both OS.
My question is - how to RESTORE data if zfs pool was owerwiten from zroot to zpool? Its it possible?
 
If you've created a new pool on top of it, no. All the pointers to the old pool are gone.
But I did not write whole disk with zeroes or something like that.
here what ive done:

Code:
zfs mount /dev/sda3
zfs mount
mount /dev/sda3 /media/
sudo mount /dev/sda3 /media/
sudo zfs mount /dev/sda3 /media/
sudo zfs get all
sudo zpool status
sudo zpool import data
sudo zpool import /dev/sda3
sudo zpool create -f pool1
sudo zpool create -f pool1 vda
sudo zpool create -f pool1 sda3
sudo zpool list
sudo zfs get mounted,canmount,mountpoint pool1
df -h -t zfs
cd /pool1/
ls
this was on mint

So the data is "deleted"? :'‑(
and gone forever?
 
Where you get this commands? Not sure if I understand what you're trying to do.
 
Where you get this commands? Not sure if I understand what you're trying to do.
That what I've done when attached the ssd to linux and tried to "mout it", but I've did not mount it, i have "overwrited" the zfs pool. I'm now just want to understand how to "get data back"
 
But I did not write whole disk with zeroes or something like that.
No, but you overwrote the most important metadata that's on the disk, the thing that identifies what else is stored on it.

Sure, it would be possible to do some forensics and try to find things. Lots of work, and requires expertise. Was the data very valuable? Hire someone to recover it.

here what ive done:
...
sudo zpool create -f pool1 sda3
What part of "-f" don't you understand?
 
That what I've done when attached the ssd to linux and tried to "mout it", but I've did not mount it, i have "overwrited" the zfs pool. I'm now just want to understand how to "get data back"
You just failed to understand how zfs works, isn't about linux, zfs have the same commands in any system with zfs, you don't "mount" a partition with a zpool. The only way is to importing it.
Instead of typing commands out of nowhere without knowing what they do (such as forcing the creating of a new pool for.. uh.. recovering files?), next time pay attention to the manual or zfs documentation.
 
I've queried google exactly about this thing, yep I would like to hire someone then, to teach me how to "memorize" it it self. How much? Is it expensive?
 
No, but you overwrote the most important metadata that's on the disk, the thing that identifies what else is stored on it.

Sure, it would be possible to do some forensics and try to find things. Lots of work, and requires expertise. Was the data very valuable? Hire someone to recover it.


What part of "-f" don't you understand?
Metadata is not the actual data, am I right?
 
You've not only blindly run commands, you've run destructive commands with flags that override safety precautions.

You might be able to pay someone thousands of dollars and hope they have enough expertise to identify a MOS and recover data. There are zero guarantees of success.
 
I've queried google exactly about this thing, yep I would like to hire someone then, to teach me how to "memorize" it it self. How much? Is it expensive?
I don't know. Find some ZFS developers; that's easy to do, the source code allows you to find committers. Assume that doing forensics will take many hours ... maybe a dozen or two dozen hours. I would think that someone skilled enough to be a ZFS developer would probably charge several hundred $ per hour. Is the data worth several thousand $ to you?

And there is absolutely no guarantee that this will work; they might easily find that you have overwritten too much.

To "teach you" how to do it would take much longer; they would need to spend dozens of hours explaining how a file system stores data, how it stores where the data is on the disk itself, what the data structures really mean, how you can find the data structures on disk.

Metadata is not the actual data, am I right?

Metadata is data about data. Thence the name. Let me explain a little bit how data is stored on a real disk. We begin by defining a "well known location". It might for example be sector 42 of the disk. ZFS could declare that it will always put a disk label on sector 42, which says: This is a ZFS disk, validated by the checksum of this sector being correct, it is volume X3 in a pool named Xxx, and the master index is in sectors 123 and 456. Then there are two copies of the master index, each of which could say: this pool contains 5 disks, which are named X1...X5, and they use RAID-Z2. This disk is 98765 sectors long. The data log starts at sector 1234, and the last written point was sector 9876. The directory/inode log starts at sector 12345, and the last written point was at 19876. The file system in this zpool is called /home. The root directory of file system abc is stored redundantly in blocks 45678 and 56789. Then sector 45678 is a directory data structure, which says the directory contains the directories bob, charlie and david (all relative to the file system name). And using this data, you can now hop and skip around the disk and eventually find everything. This is metadata.

What you did: You destroyed all the metadata that tells ZFS what the pool and the derived data structures are. So all these important bits of information may be on disk somewhere, but nobody knows where. We might be able to find them by doing an exhaustive search. That is very hard, requires writing specialized tools, and carefully interpreting half-broken bits of data.

I just want to get my /home back. Asking for Recipes
Recipe? (a) Don't destroy it. (b) Find someone who might be able to recover it. (c) Spend months learning ZFS internals to do that task yourself. (d) Give up and read the backup tape. You have a good backup, right?
 
… flags that override safety precautions. …

blind0ne to be doubly certain that you understand, force was applied by this part of your commands:

-f



For the future, it's also good to be aware of dry run options. With fortune(6) enabled, I occasionally receive FreeBSD tips such as these:

Before deleting a dataset or snapshot, perform a dry run using the -n parameter. This is to make sure you really want to delete just that dataset/snapshot and not any dependent ones. ZFS will display the resulting action when -n is combined with the -v option without actually performing it:

zfs destroy -nrv mypool@mysnap

Once you are sure this is exactly what you intend to do, remove the -n parameter to execute the destroy operation.
-- Benedict Reuschling <…@FreeBSD.org>

You can delete a range of ZFS snapshots (a-z) in multiple ways.

The following will delete d and all earlier snapshots:

zfs destroy mypool/data@%d

To delete d and all later snapshots:

zfs destroy mypool/data@d%

To delete all dataset snapshots:

zfs destroy mypool/data@%

Make sure to let ZFS perform a dry run (-n option) first and display (-v) what it would do to confirm that the delete operation is removing exactly what you
intended.
-- Benedict Reuschling <…@FreeBSD.org>
 
I've deleted and cleared up the disk before found this tool: testdisk. Didn't try it to restore zfs, but it works on forensics with destroyed ext.
 
When I last performed data recovery for a colleague, I used (amongst other things) DDRescue-GUI. From my notes at the time: "Booted instead from a USB flash drive with the latest image for Kubuntu, with gparted and DDRescue-GUI added.".

 
Back
Top