In the process of trying to get an IDE drive with a big ext3 fs mounted in openbsd, I sort of wrote an ffs filesystem over top of it. "newfs -N" was what I was looking for. I forgot the -N.

newfs, mount_mfs - construct a new file system

-N Causes the file system parameters to be printed out without
really creating the file system.

So I was wondering if any data recovery is possible and where to begin looking? The ffs only took about 30 sec to build on a 180gb drive so I would hope some files might be recoverable since there's no way every block was written to.

In any case keep the overwritten ext3fs partitions read-only no matter what. The last thing you want is any well-meant process stirring in the bit soup and so loose any chance of recovery. Now if the majority of data was human readable text you could use grep on it. If the majority of files was binary, like images, you could try a simple forensics tool like Foremost. What you're able to recover depends on a lot of things but I'll not go into details now if you don't mind. If all else fails you can still try to recover data using forensic tools but the ROI (time invested vs guaranteed results) is wickedly low.


where to begin looking?
//Searching LQ I would guess. We've amassed quite a bit of threads on this unfortunate subject.