0

I used dd when I did a very dumb thing. Yes, I did override the wrong drive.

I run dd if=file_on_sdb1.iso of=/dev/sdb1 conv=fsync. (Please note: /dev/sdb1/ and not /dev/sdb!) It didn't run completely. I interrupted it after ~20s I guess. (It was connected via USB2.)

The device which was /dev/sdb then is a 1TB (~998GB) HDD USB disk. It is formatted with GPT. It contains one huge partition which takes up all the space. That one is formatted with ext4.

There was a lot (~50GB I guess) of data on there that I'd like to recover.

The file I used for overriding (file_on_sdb1.iso) was maybe ~2.5GB big. That means it probably didn't override everything. It's 20 times smaller, how could it?

What I know

  • the partition table is still there
  • I can't simply mount the hard drive (no usefull data)
  • the first superblock is destroyed

What I'd like to know

  • Does there (most likely) still exist one of old superblocks? (I can't believe that all the superblocks are overriden first. What would they do this for.)

Bonus points for tips for recovering the data.

Tim_Stewart
  • 5,884
  • 3
  • 11
  • 33
Asqiir
  • 149
  • 10
  • 2
    Ouch. The correct answer would be "restore from backups". If you don't have backups, then there's a lesson to be learnt from this incident. – gronostaj Sep 03 '20 at 10:47
  • I guess so :-/ But I'd still like to know more about how dd overrides and how the whole "what data is still there" is influenced by where the data was originally written. I mean, it can't have overriden everything. Some Inode-blocks and some data-blocks are still there. Question is, can I find them / get them to work. – Asqiir Sep 03 '20 at 10:51
  • 1
    You can always try file carving with `photorec` as a last resort. You'll need a second drive though. – gronostaj Sep 03 '20 at 10:54

1 Answers1

1

Based on your information you can calculate the size of the overwritten area by approx. 45 MBytes/sec *20 sec= 900 MBytes, but not more than 2,5GByte.

You are wrong when stating:

It is formatted with GPT.

It is partitioned with GPT. Formating is referring to structuring a file system.

Testdisk should be able to find superblock backup information. That does not bring back your overwritten ~GByte but it could be possible that you will be able to extract parts of the filesystem.

Photorec as recommended by gronostaj does not provide you with file names and folder structure. Use this when Testdisk fails.

r2d3
  • 3,298
  • 1
  • 8
  • 24
  • Now I have an image of said partition (not the whole disk, the partition only). Testdisk's option seem not to apply? (Since for example the partition table isn't lost at all.) 1) I select the .img. 2) I selected "intel/pc partition since that was the only option which was a "partition" and not a "partition table". 3) even then it only wanted to search for lost partitions and not for a ext4 file tree – Asqiir Sep 04 '20 at 08:32
  • Testdisk works on disks. The best thing would be to duplicate your logically broken drive to a disk of the same size and select this disk within the main testdisk menu. The selection of INTEL/PC tells Testdisk to assume on old school partition table instead of the modern GPT. – r2d3 Sep 04 '20 at 20:02