add stories

stories/data_recovery.md

@@ -0,0 +1,29 @@
+# Data Recovery
+
+## Lost btrfs filesystem
+
+1. BTRFS expects its header (`_BHRfS_M`) to be 64KiB offset from the start of the disk
+
+```bash
+# Find the byte position of _BHRfS_M
+# Convert this to dec before using the number
+hexdump -C borg.raw | less
+
+# Create a loop device starting at that position
+# Device will be created at /dev/loopX
+# -f finds the first available number to use
+# -P scans the partition table
+# -b is sector size
+# --offset 8388672 sets the offset if there are partitions ahead of the one you're after
+# use the byte offset above
+losetup -fP -b 4096 borg.raw
+
+# List loop devices
+losetup -l
+
+# Mount the partition
+mount /dev/loop0p1 /mnt/restore
+
+# Delete the loop device when done
+losetup -d /dev/loopX
+```