On 2017年12月30日 03:30, Stirling Westrup wrote: > You were right! grep found two more signature blocks! How do I make use of > them? > > videon:~ # LC_ALL=C grep -obUaP "\x5F\x42\x48\x52\x66\x53\x5F\x4D" /dev/sde > 65600:_BHRfS_M
This the correct one. Offset is 64K + 64. > 26697111807:_BHRfS_M It is a little tricky now. Btrfs has its superblocks at: 64K (primary) 64M (backup 1) 256G (backup 2) While this one is at 25G and has offset which is not 64 (magic inside superblock). Is there any btrfs image inside the fs? > 26854350428:_BHRfS_M Much like the previous one. Despite that, you could try to use "inspect dump-super --bytenr" to check if it's the super you want. The bytenr you could pass is: 26697111743 26854350364 And at this point, I would say the chance to recover data is really very low now. Thanks, Qu > > On Thu, Dec 28, 2017 at 11:00 PM, Qu Wenruo <quwenruo.bt...@gmx.com> wrote: >> >> >> On 2017年12月29日 11:35, Stirling Westrup wrote: >>> On Thu, Dec 28, 2017 at 9:08 PM, Qu Wenruo <quwenruo.bt...@gmx.com> wrote: >>>> >>>> >>> >>>> >>>> I strongly recommend to do a binary search for magic number "5f42 4852 >>>> 6653 5f4d" to locate the real offset (if it's offset, not a toasted image) >>>> >>> I don't understand, how would I do a binary search for that signature? >>> >> The most stupid idea is to use xxd and grep. >> >> Something like: >> >> # xxd /dev/sde | grep 5f42 -C1 >> > > >
signature.asc
Description: OpenPGP digital signature
