2016-08-08 20:13 GMT+03:00 Chris Murphy <lists@xxxxxxxxxxxxxxxxx>: > Just a wild guess, the deletions may be in the tree log and haven't > been applied to the other trees (fs tree, extent tree, etc). So yes > I'd expect they get deleted on a rw mount. > > This is what kernel? Because kernel 4.6 offers mount option > "nologreplay" which suggests even if you do mount -r that log replay > happens, so you shouldn't see these deleted files unless you mount ro > *and* use nologreplay mount option. Live USB has kernel 4.5.7. Maybe I should try to run "btrfs rescue zero-log" and then mount RW? Will the files safe in that case? > Anyway, even 5 seconds of rm -rf damages too much. If you don't have > recent snapshots then it's not sanely salvageable, just reinstall. As I could see, almost all the "deleted" files are present. Certainly, I'll make an rsync diff between two-week-ago snapshot and the current FS state. But it will better if in-place recover without backup is possible. P.S. IMHO, log replay by default is a quite dangerous thing. I didn't know about that change and I could lose all files if the live USB had 4.6 kernel)) -- Ivan Sizov (SIvan) -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
