The Quest for the Holy Disklabel

[girarde]

Installing 6.0 for a backup server. Began installing to the wrong disk. That is to say, the disks that the backups done over USB on it. scan_ffs output:

ed@foop(~)$doas scan_ffs sd0c
ffs at 256 size 1073741824 mount /usb/0a time Tue Jul 26 14:06:37 2016
ffs at 10977248 size 4294950912 mount /mnt/tmp time Tue Jul 26 14:07:02 2016
ffs at 19365824 size 12851036160 mount /mnt/var time Tue Jul 26 14:07:07 2016
ffs at 44465504 size 2147483648 mount /mnt/usr time Tue Jul 26 14:07:03 2016
ffs at 48659808 size 1073741824 mount /mnt/usr/X11R6 time Tue Jul 26 14:07:04 2016
ffs at 50756960 size 10737418240 mount /mnt/usr/local time Tue Jul 26 14:07:04 2016
ffs at 71728480 size 2147483648 mount /mnt/usr/src time Tue Jul 26 14:07:07 2016
ffs at 75922784 size 2147483648 mount /mnt/usr/obj time Tue Jul 26 14:07:06 2016
ffs at 2158656422 size 2293760 mount /mnt time Sun Apr  6 15:10:33 2014
ffs at 2646484042 size 293076992 mount /mnt time Sun Sep 18 15:40:21 2016
ffs at 2740322418 size 2293760 mount /mnt time Sun Apr  6 15:10:33 2014
ffs at 3121295664 size 293076992 mount /mnt time Sun Sep 18 15:40:21 2016
ffs at 3433503194 size 2293760 mount /mnt time Sun Apr  6 15:10:33 2014
ffs at 4946913598 size 2293760 mount /mnt time Sun Apr  6 15:10:33 2014
scan_ffs: read: Invalid argument

Currently the partitions that install created are removed, except for sd0c. I don't remember with certainty if I had left a FAT or ntfs partition on this disk at the time of the accident (21 Feb 2017), but probably not. The server chassis had been unused for a long time and had lost it's RTC setting. which may be where the July 26 stuff is coming from.

The disk is currently unmounted, attached USB. Some of the files on it represent archive, not just backup, so if they're gone it's actual data loss, not merely higher risk until more good backups are written. Any ideas?

[jggimi]

If this were me, I'd first look for backups of the disklabel. Failing that, I'd loop through the following steps with each detected filesystem from scan_ffs.

1. create a disklabel with a detected filesystem
2. attempt a read-only mount
3. if successful, inspect and save any good, critical information elsewhere.

Seems pretty simple, except for when you have unsuccessful mounts or damaged data. Those, it might be possible to recover data using sysutils/sleuthkit. When I have used this, as its a large set of tools, I've installed and used their autopsy webserver to make it a little easier to use. My success rate using sleuthkit has been much higher recovering FAT filesystems than FFS. FFS recovery approaches 0%.