OK, I'll admit it, it was a dumb thing to do. I was using dd to copy a disk image onto an SD card for a Raspberry PI, but managed to copy the image onto /dev/sda instead of /dev/sdc. Problem now is, of course, that I've nuked the entire MBR and directory structure of the hard drive. I've reconfigured with a new drive, and this time I've dual booted the thing and taken a copy of the MBR so that if the same thing happens again, it will only clobber windows.

What I want to know is, is there any way at all to recover the file system once the first few GB of the hard drive have been overwtitten? I can use photorec to recover the files, but I think what I have is more a large collection of file fragments. I'd really like to recover the directory structure if I can.

  • You didn't mention the filesystem your drive was fomated with: ext2,3,4, btrfs, reiserfs or whatever. As nis information might give a clue how probable it might be to reconstruct more than you are already achieving, I suggest you add this information. – mikyra May 26 '15 at 2:01
  • Hi, the filesystem is ext4. Are you able to suggest a filesystem that would be able to survive such a catastrophe? – Tony Kerr May 26 '15 at 6:43

In this case I'd simply retrieve all your files from your backups. ;)

Overwriting the first few GB of a partition will have wiped out enough of the filesystem's structure that it is unlikely you will be able to retrieve file metadata in a meaningful way.

Now, since you did it to the entire drive (/dev/sda) it is possible that you have intact partitions that start after the part that you wiped, that could be 100% restored. In this case you can run testdisk to search for the lost partitions and restore them to the partition table, then you should be able to read and write them as normal.

Most likely, however, you will have overwritten the start of a partition you really wanted, and you will be stuck using photorec which searches through what's left and finds non-fragmented files by their file signature.

One tip about how I use photorec: set it only to identify the file types you most want, and don't be afraid to run it multiple times with different/more file types selected each time. This may decrease the chances that something will be mis-identified (some files may identify as more than one type). I don't know how effective that actually is, but I do it. My most frequent reason for using photorec is when someone I know has a corrupted, or accidentally formatted, memory card for their camera, or something, so I narrow down the file types it's looking for to just JPEG/M2TS/MOV or whatever types of files the camera takes.

  • Thanks, that's just what I feared. I've rebuilt using a new hard drive with a sacrificial partition (windoze) at the beginning, and taken a copy of the first 4096 blocks. It's frustrating that modern filesystems aren't more bulletproof. The old Amiga filesystem treated directories as ordinary files, and put the root directory in the centre of the disk. Although spreading the directory structure all over the disk made things a little slower, it meant that you could recover just about everything if there was a crash. – Tony Kerr May 26 '15 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.