17

I'm an idiot, I was writing an image to a USB drive using dd when instead of typing /dev/sdb I typed /dev/sdd and wrote the 135mb image to my 750gb External Hardrive full of files. Is there ANY possibility of recovering the files or did dd completely zero out the drive? Please help, as this is one of the lowest points of my life EVER.

dd finished writing the 135mb image in 5 seconds, so I didn't have a chance to stop it. By the time I knew what happened to was too late. The command was as follows:

sudo dd if=generic.img of=/dev/sdd bs=1M

EDIT2: The External Harddrive's filesystem was FAT32(I've had the drive for awhile and FAT32 was the most Universal FS at the time). I also have a 2TB drive I just got which I was planning on moving most of the files to from the 750gb, If needed I can use it to transfer the Recovered files to.

4
  • Did you abort the dd command at 135mb ?
    – viyyer
    Jan 10, 2012 at 20:02
  • dd finished writing the 135 IMG in 5 seconds, so I didn't have a chance to stop it. By the time I knew what happened to was to late.
    – japzone
    Jan 10, 2012 at 20:06
  • is it a ext4 filesystem ?
    – viyyer
    Jan 10, 2012 at 20:18
  • 1
    If at all possible, all the operations you do should be done on an image of the drive, not the drive itself. If that's not possible always make sure the drive is mounted read-only. Trust me on this, it's easy to accidentally make things worse...
    – detly
    Jan 11, 2012 at 7:19

5 Answers 5

8

When a drive has been accidentally overwritten you will need Data Recovery Tools to restore the remainders of your data. When this has occured from running dd for a 135 MB image then those parts of your drive are definitely gone and can not be rescued.

By installing

TestDisk Install testdisk

you may be able to recover part of your files. Included in the TestDisk suite you will also find the tool PhotoRec that helps to recover individual files even in the case the partitions can not be restored by testdisk or the drive itself has a hardware defect.

TestDisk/PhotoRec can also be run on an image of your drive (as was also suggested by this answer)

3
  • In the end I gave up recovering the data since most of the files I wanted weren't common formats and aren't supported by photorec. Oh well.
    – japzone
    Jan 24, 2013 at 11:13
  • @japzone: if it was FAT32 you may also have some luck with Windows recovery tools.
    – Takkat
    Jan 24, 2013 at 11:28
  • Nope, no such luck. It looks like dd overwrote enough information that it was mostly unrecoverable. A file recovery tool worked, but, as I said above, most of the files I would have liked to recover aren't supported by any file recovery tools.
    – japzone
    Jan 30, 2013 at 21:33
3

You can try to recover files from your HD with foremost. Foremost will try to recover only certain types of files (jpg, doc, rar, zip, htm, bmp, and quite a few others), though, so I believe it won't help to recover everything.

Basically, what I would try to do is:

sudo foremost -v -t all -i /dev/sdd -o ~/DISK_RECOVERY_FOLDER

While the command scans all your sdd HD, cross your fingers (even though it will take quite a bit)

Optionally, you can dd your whole 750Gb HD to some greater drive with enough space and run foremost on that image file, instead (not that foremost writes it, though.... just for speed if you want to run several recovery tools on that image). Something like_

sudo dd -if=/dev/sdd -of=image.dd

and change the foremost command to:

sudo foremost -v -t all -i image.dd -o ~/DISK_RECOVERY_FOLDER

Hope this helps

2

DD AFAIK writes the files contiguously so you lost whatever was in the first 750 mb of your disk.

I think the first thing to do would be try and backup the whole image if possible so that if you try one tool and it changes the file systems you can go to another tool and see if it gets better results.

To backup the whole disk image you might need another 750gb harddrive to copy the image to. I would use a live CD/USB of clonezilla and copy the files to backup the whole disk image.

One of the tools I had a lot of successful with recovering partition tables is testdisk . I would recommend using the System Rescue CD and boot using it using a CD or a USB. One thing to remember boot with 64-bit system rescue if you had a 64-bit operating system installed, because if the / partition is fully available it will possible to chroot and fix the setup only using similar kernels.

Boot into system rescue CD and run testdisk.Using the menu choose analyse and see if it find the partition table. I would think you would need to run the deeper search for to find the partition table by brute force and it might not succeed in detecting the partition type of the first partition. So give it a name and try recover the partition tables. and then backup recovered files.

Edit: Now finding that it is fat32, I think it would be easier that what I thought as there would be many fat recovery tools. You can use them to generate the fat table and the directories structure and specific file could be recovered using tools like photorec. ubuntu rescue remix has photorec and testdisk both.

Edit: added information for cloning disk contents of the hard drive.

3
  • 4
    "...backup the whole image if possible..." This seems like sound advice. Care to elaborate on how one would go about doing this? Jan 10, 2012 at 20:39
  • 1
    No need to run a live system if it was only an external drive.
    – Takkat
    Jan 10, 2012 at 20:44
  • 1
    @MichaelMS added the information about how one could go about backup the whole image.
    – viyyer
    Jan 10, 2012 at 20:57
1

I'd recommend a computer forensic tool, like SleuthKit to read through the remains of your disk structure, and figure out what looks like structure, and what looks like data, and help you recover.

1

I agree with fellow community members here,testdisk,foremost and sleuthkit. And also you can also try extcarve www.giis.co.in/giis/. Most important thing, before you try any/all of these tool.Make sure you backup all your 750GB usb to the new 2TB drive and then start running them. You said,external drive has lot of files. It that any specific files like mp3 doc etc or just collection of whole lot of things.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .