Username: 
Password: 
Restrict session to IP 
Online within 1d

BTRFS file recovery

Global Rank: 135
Totalscore: 143258
Posts: 128
Thanks: 109
UpVotes: 127
Registered: 12y 47d
occasus`s Avatar



Last Seen: 113d 19h
The User is Offline
BTRFS file recovery
Google/translate1Thank You!1Good Post!0Bad Post! link
Hello all very dear Challengers,
LongStoryShort:
Quote from occasus
Before assuming smth worked w/o errors, pls check twice!!!

I'm trying to recover some .odt and .pdf files from my overwritten system. These (about 20) odt files were extremely important to me and began to write these in 2000/2001 and constantly updating up to yesterday.

Before upgrading from ParrotOS 6.19 to ParrotOS 7.1, I copied my /home/occasus folder into a flash disk. It took quite all night. This morning i did the upgrade. Then wanted to copy from the flash drive the folder /home/occasus/WeChall with all odt's and pdf's into the new system.

To my surprise, I realized it copied only useless stuff.


First I immediately shutdown the system, and rebooted with the live version of ParrotOS7.1. Then tried to follow some steps... Binwalk, Scalpel, Foremost, PhotoRec. Magic bytes of ODT (50 4B 03 04) since they are zip; and PDF (25 50 44 46 2D) where not needed to be added into these tool's config files.

At moment I'm just crying, with my laptop powered on into live mode. The physical disk is a 1TB NVMe... nvme0n1 (with the two logical nvme0n1p1 and nvme0n1p2).

At the moment I am playing around and reading docs about the btrfs command itself (DiskInternals - btrfs)

Did something similar happened someone already?
Global Rank: 374
Totalscore: 66437
Posts: 274
Thanks: 258
UpVotes: 278
Registered: 15y 319d
space`s Avatar
The User is Offline
RE: BTRFS file recovery
Google/translate2Thank You!1Good Post!0Bad Post! link
I'm very sorry for you.
It happened to me once as well (many years ago but on the hardware side), and I lost much important stuff.
I sometimes also removed some directories accidentally, since then I carefully check things before any operation (like dd, parted, etc) and alias "rm=rm -vi".
and use rsync to backup certain important folders.

There are some more recovery tools than the listed ones. E.g. if one drops the wrong partition, other utilities are required.
I don't remember the exact names. Often got help in linux related IRC channels.
Contact only via c3BhY2VAd2VjaGFsbC5uZXQ= or PM...
Windows can be secure... but only if you don't use it Happy
Global Rank: 135
Totalscore: 143258
Posts: 128
Thanks: 109
UpVotes: 127
Registered: 12y 47d
occasus`s Avatar



Last Seen: 113d 19h
The User is Offline
RE: BTRFS file recovery
Google/translate1Thank You!1Good Post!0Bad Post! link
Thanks for replying space. Fortunately I found in one of my many external drives a backup of the entire /home/occasus directory. Indeed I used

rsync -arv /home/occasus/ /media/BAK_3TB/backup/

. Unfortunately the last time was May 08, 2021. Counting the effectively lost occasus' chall notes are 169
overthewire, ysx_hacking, klinsten, quangntenemy, TheHiveMind, Z, balicocat, Ge0, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, fpombal, csuquvq have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 199 times.

PHP Fatal Error(1): Constant E_STRICT is deprecated since 8.4, the error level was removed in www/protected/config.php line 6


Backtrace starts in [unknown file] line ?. GWF_Debug::shutdown_function() core/inc/util/GWF_Debug.php line 109. GWF_Debug::error_handler().... core/inc/util/GWF_Debug.php line 180.