0

So yesterday I was installing a couple of distros in a new computer I got, when I was creating a Live USB through the command line with the DD command and I accidentally chose the incorrect device. (Pretty smart I know)

My hard drive is a WD Passport 4 TB which makes any recovery tool take quite some time to analyze.

I had 4 different partitions on this hard drive, 2 of them encrypted (I remember the password and all) a ext4 partition and a FAT32.

The only way that I know to recover files is using testdesk or photorec but they don't seem to be finding the encrypted part of the partition only the non encrypted one.

At the moment I'm trying to recover data with Gpart but it's been a few hours and nothing yet.

Anyone know an idea of how I could do this more efficiently ? (Recover the data from the encrypted partition)

Partition was encrypted with LUKS using the gnome disk utility.

Thank you everyone in advance.

Improve this question
4
  • I'll only provide a suggestion to avoid dd. (I wiped a 2tb drive & didn't learn lesson, did it again loosing 11tb drive array .. then finally switched to mkusb; it's great!). If your data is encrypted, I would forget about it .. If drive is still mounted, I'd suggest copying non-backed up data off it
    – guiverc
    Mar 29, 2020 at 3:07
  • @guiverc Honestly I think as long as you use lsblk so verify the drive it's fine. Normally I use BalenaEtcher but I thought it would "save" me time to use DD instead. Thank you for the suggestion tho. :)
    – VAGLinux_sudo
    Mar 29, 2020 at 3:11
  • Do you know how much data and to which partition you wrote with dd? You say you had two encrypted partitions, unless you filled up the whole drive somehow, at least one of them should still be accessible.
    – Sebastian
    Mar 29, 2020 at 14:17
  • @Sebastian Thank you so much for your response. I'm sure I did a back up of the headers but I have no clue where. I will consider this lost and learn my lesson. Thank you sir
    – VAGLinux_sudo
    Mar 29, 2020 at 15:03

1 Answer 1

Reset to default
1

If the partition you overwrote was encrypted with LUKS and you do not have a header backup of it somewhere, then the data is gone for good. Even knowing the password does not help in that case, since the actual data is encrypted with a master passphrase, and your password is only used to unlock that master passphrase. Actually, what you did is sometimes recommended to quickly and reliably wipe a LUKS partition.

If you do have a header backup, you could try copying that back to the beginning of the damaged partition. Since then you would probably still have overwritten the partition table of the filesystem of the encrypted partition, you could at that moment only try to run a recovery tool through the mapped / decrypted partition.

So in short: No header back -> data is lost.

Improve this answer
1
  • Hello! Just and update I would like to add. I opened the command line and logged into the root account and then ran Testdisk and I was able to find one of the encrypted partitions and recover like 99% of the documents. I will backup the header next time tho.
    – VAGLinux_sudo
    Mar 29, 2020 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .