btrfs and hexdump

Today I made a silly mistake. I hit tab-complete one too many times and accidentally removed a project instead of a symlink. This could have been disastrous but I have backups and remote copies of the code.¹ Since I was confident with my backup strategy I decided to experiment. What if I use hexdump to find my files?

Now for an attempt at reverse engineering my thought process.

1. My home directory is stored on a btrfs volume.
2. btrfs uses copy-on-write.
3. Therefore my files should still be intact (even if I zeroed out the files).
4. hexdump can present the raw contents of a file.
5. Everything in linux is a file.
6. Use hexdump to display contents of hard drive /dev/sda2

Conveniently btrfs stores the filename at the end of a file block (at least for small enough files). This made searching trivial, just search for the filename. A few rounds of copy and paste later, my project was back.

While hexdump is not the ideal answer for data recovery it works.