Re: Looking for confirmation as I enter the acceptance stage.

On 26 Jul 2023 12:10 -0400, from [email protected] (blobfish):
> command: sudo file -s /dev/dm-4
> result: /dev/dm-4: BTRFS Filesystem label "mediaLibrary", sectorsize 4096, 
> nodesize 16384, leafsize 16384, UUID=0e2b9dfb-46ca-4064-bd09-826431b4eafb, 
> 6943296638976/8001469083648 bytes used, 1 devices
> 
> another good sign!

Absolutely!

At this point I feel confident enough to say that you have a _very_
good chance of getting your data back, because:

* We've found a way to open a copy of the first few hundred MB of the
broken LUKS container (by nothing more than introducing an offset, as
it happens)

* The LUKS header that gets used for that appears undamaged

* The contents of the opened container look sensible (which leads me
to believe that there's a good chance that the full file system within
the container is largely undamaged)

Ideally, the next step would be to use the copy you made of the broken
container (that is, in effect, the new drive) to extract data, while
keeping the original untouched until you have a copy (so that if you
make a mistake, you can start over from the original). _Do you have,
or can you get, anywhere that you can realistically put that ~7TB of
data during copying?_

I suspect that the safest approach would be to set things up to open
the actual LUKS container and mount the Btrfs file system(s), copy the
data out, then create a new LUKS container on that drive, then copy
the data to there; then once you've verified that it's a good copy,
create a new LUKS container on the other drive, and set up to use that
for backups going forward. This, however, requires creating a third
temporary copy of the data currently within that Btrfs file system.
Conveniently, `file` tells us how much data that is.

If you can't get somewhere to realistically and temporarily store the
data during copying, it would be possible to work with only the two
drives you currently have; but that would mean introducing the risk of
writes to an only copy, which is rather anathema to data recovery (and
especially since we don't yet know the state of that Btrfs file system,
I'm still thinking in terms of data recovery). Hence my question above.

-- 
Michael Kjörling                     🔗 https://michael.kjorling.se
“Remember when, on the Internet, nobody cared that you were a dog?”