Hello, I had a similar issue. On OpenSuse I deleted /.snapshots/ and was not aware that /.snapshots/1/snapshot/ is the default subvolume representing my root file system. So I had no snapshot left, all ro subvolumes have been deleted before, and the default subvolume had big parts deleted before I cancelled the rm -rfv. I kept a copy of the STDOUT listing the deleted files and switched off the power of that filesystem immediately, no sync or umount. There have been no additional writes, so I was quite sure the data must still be there. I booted a live version of the OpenSuse TW. However btrfsprogs are missing the important btrfs-find-root, so I compiled the progs from the very recent github revision. After I played with the btrfs restore and --path-regex I had no success, finding some of the files that have been deleted. I found a copy of the btrfs-undelete script and played with that: https://gist.github.com/Changaco/45f8d171027ea2655d74 I learned how to traverse the root-ids to older generations, but the script found absolutely none of the deleted files. I modified the script to use btrfs-find-root -a which found some more root-ids but still no success, for instance: # btrfs-undelete /dev/mapper/_root "/@/.snapshots/1/snapshot/etc/cron.daily/1btrk.cron" /mnt/usb/rescue Trying root 88866816... (329/332) Trying root 66764800... (330/332) Trying root 66600960... (331/332) Trying root 60571648... (332/332) Didn't find '@/.snapshots/1/snapshot/etc/cron.daily/1btrk.cron' I did not trust the obscure --path-regex. I also reproduced what the script does, using regular expressions like '^/(|@(|/.snapshots(|/1(|/snapshot(|/etc(|/cron.daily(|/1btrbk.cron)))))))$' However I did some btrfs restore --dry-run and grepped the known files myself, until I found older root-ids containing almost all of the missing files with meta-data. The snippets I like to share here: # btrfs-find-root -a /dev/mapper/_root |grep Well |cut -d '(' -f 1 |awk '{print $3}' | while read -r rootid ; do echo "### rootid: $rootid"; btrfs restore -t $rootid -Dvi /dev/mapper/_root /mnt/usb/rescue/;done 2>/dev/null |grep -e "### rootid" -e "1btrbk.cron" ### rootid: 245530624 ### rootid: 245022720 ### rootid: 244760576 ### rootid: 242139136 ### rootid: 242892800 ### rootid: 241942528 ### rootid: 209518592 ### rootid: 144097280 ### rootid: 147816448 Restoring /mnt/usb/rescue/@/.snapshots/1/snapshot/etc/cron.daily/1btrbk.cron ### rootid: 123863040 Restoring /mnt/usb/rescue/@/.snapshots/1/snapshot/etc/cron.daily/1btrbk.cron Best regards, Massimo
