UFS drive overwritten for 3 minutes!

[Tevian]

This is another story of carlessness with hard drives when moving a server. I'm moving from Freenas to Unraid. Got new server setup and pulled a drive from Freenas to use as a parity drive in Unraid. Turns out I pulled the wrong drive! Parity sync ran for about 3 minutes on a 3TB drive. Long story short, the drive has important stuff on it. The drive was UFS I believe. The drive was not part of an array. The drive was not ZFS. I've read about others with similar situations but with no clear route for success. Am I totally screwed? I've tried a few software recovery options but nothing seems to be able to read this thing. The disaster is still fresh. I would appreciate any help with what I should try next.

 

[jgreco]

Your level of screw-ed-ness is proportional to how willing you are to either work very hard or pay money to retrieve whatever might be retrievable off that disk. Fortunately, UFS/FFS isn't that terrible. Unfortunately, this doesn't really have anything to do with FreeNAS, so I'm moving it to offtopic.

 

[Tevian]

Well... the drive was formatted and came from a Freenas server. Saying it has nothing to do with Freenas is a stretch. By I completely understand. I was going to post in offtopic first but wasn't sure. :)

 

[jgreco]

Sorry, but FreeNAS hasn't supported UFS in a long time, and basically the disk became non-FreeNAS when you started formatting it in something else. You'd be better off asking in the general FreeBSD forums, because the drive much more closely resembles a FreeBSD OS disk.

The one thing that might be a bit relevant is that FreeNAS typically puts a 2GB swap partition on the disk, at the start, but modern drives typically write at 100-200MB/sec so you could have blown through that in about ten or twenty seconds. Basically my best guess is that you'll probably have toasted all the most useful metadata on the disk if it was trying to create parity information on the new disk. Maybe that's what happened, maybe not.

The usual procedure would be to look for things that look like superblocks and inodes on the shredded tatters of your filesystem, and hope that some of them are directory inodes, which would allow you to gain access to the files within, assuming no damage to the data blocks. The remainder would be file inodes, for which filenames would be lost, but the data within the files might be fine. Commercial services like UFS Explorer apparently have some pretty aggressive algorithms for searching out such data.

 

[Tevian]

Ok I understand. I'll try the BSD forums. I'm off to look into superblocks and inodes.

 

[jgreco]

We do wish you luck, though, and if you find a solution, feel free to come back and tell us how it went.

 

[Tevian]

Update:
With some advice from this forum and others I've tried a program called UFS explorer. This program might save my butt! Drive had no readable partitions so first step was to 'find partition' which took about 30 minutes. It did detect an unreadable UFS partition at some sector count like 181,000,000. Now I'm doing the data recovery part. ETA is 17 hours. Fingers crossed but this might get me what I need. If it's there I will have to purchase though.

 

[Robert Trevellyan]

As a last resort you could try something like photorec. It won't restore filesystem structure but it can find individual files.

 

[Bidule0hm]

And maybe image the drive before doing anything further, if you try a software who mess-up the drive then at least you have an exact copy of the original version ;)