Restoring drive after using dd on it...

thom_raindog · 2011-02-09 16:10:06

(Edith changed the title of this thread somewhat once its direction changed...)

Howdie,

I suspect that when the wiki here: https://wiki.archlinux.org/index.php/Pu … _a_USB_key states:
Warning: This will irrevocably destroy all data on /dev/sdx.
that is to be taken as a fact, no way around it, right? Just asking, cause I just managed to get distracted when firing that dd command and aimed at my backup harddrive instead of my usb-stick, where, ironically, my backup HD is intentionally usually NOT mounted, to protect it, so dd did actually work and turn my several GB of backups into a useless installation medium.

Now, would there be ANY chance to get my data back? Just askin...

Last edited by thom_raindog (2011-02-20 15:25:52)

SanskritFritz · 2011-02-09 16:15:23

If you have overwritten the disk with other data, then yes. If you have copied much less than your backup, then most of the data is still on the disk. Use this liveCD: http://www.sysresccd.org/Main_Page

litemotiv · 2011-02-09 16:19:42

thom_raindog wrote:

ironically, my backup HD is intentionally usually NOT mounted, to protect it, so dd did actually work and turn my several GB of backups into a useless installation medium.

Yes dd is explicitly used on non-mounted media..

metzengerstein · 2011-02-09 16:20:09

https://wiki.archlinux.org/index.php/File_Recovery

Srf_rs · 2011-02-09 16:24:50

It isn't backup if you only keep one copy. So technically, it looks like you have overwritten your data drive.

Good luck.

thom_raindog · 2011-02-09 19:14:18

Srf_rs wrote:

It isn't backup if you only keep one copy. So technically, it looks like you have overwritten your data drive.
Good luck.

Wise, wise.. and true. As things go, this hit me at a time when neither of my two PCs were propperly filled with my data since I had recently redone some stuff on them; they are pretty well empty. My only hope is my netbook which will hold at least a fair portion of my data, but, low and behold, it suffers from a failing HD AND a kernel panic right now, so: Must be my lucky day..

Thanks for the input, guys. Will look into those links.

hbekel · 2011-02-09 20:21:47

This is why you should always think "data destroyer" while typing "dd". Helps to stay focused

eldragon · 2011-02-09 20:44:13

Srf_rs wrote:

It isn't backup if you only keep one copy.

+1

thom_raindog · 2011-02-20 15:31:46

I looked at both the links provided. Maybe you guys can give me a few pointers before I try my hand at this and make matters worse...

For one, without buying another harddrive I will NOT be able to work on an image as the HD in question is about three times the size of my main drive. To be more clear on the state of things: I used dd on my 190GB HD to put a 2 or so GB image onto it (that was meant for the USB-Stick) so a good 187 GB are definitely untouched. What is the right oder in which I tackle this? For now I have no clue if dd happened to put the stuff somewhere that had been "blank" before, nor do I have any idea how to find this out.

Generally, testdisk sounds like a good idea, as it can restore fix partition tables, but if I should use that do I do that before or after using something like Photorec to save my pictures and other files? Who can give me a solid starting pointer here?

thisoldman · 2011-02-20 16:34:25

An old page, http://www.cgsecurity.org/wiki/After_using_TestDisk, suggests:

Try PhotoRec if you want to recover files and the system is too badly damaged to be repaired.

So the order suggested is TestDisk first, then PhotoRec.

I've never had to use the two in combination. Please keep us informed of a successful end or if it's a failure.

davidm · 2011-02-21 13:57:47

thom_raindog wrote:

so a good 187 GB are definitely untouched.

Okay so then you have a very good chance of getting most of your old files back. Since you don't have another large drive it sounds like you'll probably need to use photorec to get things off in a methodical order. My advice is to test out photorec on another computer first to learn it and read all the documentation. You can easily mess things up worse if you are not careful. For instance a common mistake is to try to write the recovered files to the same medium as you are trying to get data from. That just damages the chances of recovery obviously.

perbh · 2011-02-21 17:38:07

hey - these days you can have a 2TB disk for 90 bucks, 500 gigs for about 40 bucks - surely, your data is worth that kind of money?

histoplasmosis · 2011-02-22 00:08:24

Photorec is definitely the way to go. It will search the drive for the headers of each filetype specified and pull the data off the drive. I believe you can even customize it and put your own header information in if it's not searching for something you want. Testdisk is probably not going to get you anywhere.

thom_raindog · 2011-02-24 15:58:45

All in all I suppose I will dish out the dough for an external HD... if nothing else, my main drive here appears to start dying (7 year old now) so I need something new in the long run anyway...
THEN I will start digging around on an image and see where I get...

thom_raindog · 2011-03-24 05:36:53

OK, bought me a 1TB external drive. First step: Copy the whole old disk over. I used dd:

sudo dd if=/dev/old_drive of=/dev/new_drive bs=4096 conv=notrunc,noerror

which threw a couple of input/output errors while reading from the old drive.

Just installed testdisk and will start working with photorec on the new drive to see what I get.

Last edited by thom_raindog (2011-03-24 05:37:21)

thom_raindog · 2011-03-25 06:32:05

Hm... just out of curiosity: Does photorec ususally take near a day? Admitedly the HD is 1TB in size but exept for some odd 200GB its empty... I had to stop the process and now I wonder if I could have done this differently. Would there be a smart way to just make a partition exactly the same size as my "broken" one on the new drive and run photorec on that partition instead of the whole drive?

thisoldman · 2011-03-25 10:38:47

My experience with photorec was that it took nearly two hours to work through a friend's 20 Gb NTFS drive

Another choice for data recovery is ddrescue.

ChoK · 2011-03-25 17:53:10

ddrescue is useful to copy data from a failing harddrive (especially if some block are unreadable) but if the filesystem structure is damaged you will still need other tools to work on the freshly copied data.

thom_raindog · 2011-03-25 20:51:28

2h / 20GB, if I just go from there my 1TB would take 100h??? Even if photorec just scans the data that is actually there that would be easily 20+ hours. Ouch. Not to mention that my PC is some 5 years old and slow...
So, back to my last part: What would be the proffessional way to get the data of my old disk and onto my new one without copying the whole disk over? 20+ hours still sounds WAY better than 100...

thom_raindog · 2011-04-08 19:31:45

No input on this anymore?

ewaller · 2011-04-08 21:40:36

thom_raindog wrote:

...What would be the proffessional way to get the data of my old disk and onto my new one without copying the whole disk over?

As a moderator, I should not be sarcastic. That said, I will be anyway. The professional way would be to use either of your two tested backups to restore the drive and move on.

As to a more ad-hoc solution - move the drive to a faster computer.

thom_raindog · 2011-04-11 06:11:22

thom_raindog wrote:

...Would there be a smart way to just make a partition exactly the same size as my "broken" one on the new drive and run photorec on that partition instead of the whole drive?

I enjoy sarcasm as much as the guy next door, so no offense taken Now, with my self-quote here, will that make it more clear what I am looking for?

ewaller · 2011-04-11 06:33:15

thom_raindog wrote:

thom_raindog wrote:
...Would there be a smart way to just make a partition exactly the same size as my "broken" one on the new drive and run photorec on that partition instead of the whole drive?
I enjoy sarcasm as much as the guy next door, so no offense taken Now, with my self-quote here, will that make it more clear what I am looking for?

Actually, that should work just fine. It is a common technique in computer forensics to image a drive and work with the image while leaving the original intact. There is no reason (in my mind) you should not be able to work with the image of the partition. The nice thing is, that if things go South, you still have the original. Just be very careful when you copy the data from the damaged drive, you don't inadvertently do more damage with a badly constructed dd command.

Question though -- Is your partition table intact to the extend you can find the original partition?
If not, do you know exactly what it had been before? (I write mine down)
It might be possible to rebuild the partition table and restore access to partitions that were not overwritten.

If you have no partition information from the old drive, how are you to find the blocks to copy to the new drive?

Arch Linux

#1 2011-02-09 16:10:06

Restoring drive after using dd on it...

#2 2011-02-09 16:15:23

Re: Restoring drive after using dd on it...

#3 2011-02-09 16:19:42

Re: Restoring drive after using dd on it...

#4 2011-02-09 16:20:09

Re: Restoring drive after using dd on it...

#5 2011-02-09 16:24:50

Re: Restoring drive after using dd on it...

#6 2011-02-09 19:14:18

Re: Restoring drive after using dd on it...

#7 2011-02-09 20:21:47

Re: Restoring drive after using dd on it...

#8 2011-02-09 20:44:13

Re: Restoring drive after using dd on it...

#9 2011-02-20 15:31:46

Re: Restoring drive after using dd on it...

#10 2011-02-20 16:34:25

Re: Restoring drive after using dd on it...

#11 2011-02-21 13:57:47

Re: Restoring drive after using dd on it...

#12 2011-02-21 17:38:07

Re: Restoring drive after using dd on it...

#13 2011-02-22 00:08:24

Re: Restoring drive after using dd on it...

#14 2011-02-24 15:58:45

Re: Restoring drive after using dd on it...

#15 2011-03-24 05:36:53

Re: Restoring drive after using dd on it...

#16 2011-03-25 06:32:05

Re: Restoring drive after using dd on it...

#17 2011-03-25 10:38:47

Re: Restoring drive after using dd on it...

#18 2011-03-25 17:53:10

Re: Restoring drive after using dd on it...

#19 2011-03-25 20:51:28

Re: Restoring drive after using dd on it...

#20 2011-04-08 19:31:45

Re: Restoring drive after using dd on it...

#21 2011-04-08 21:40:36

Re: Restoring drive after using dd on it...

#22 2011-04-11 06:11:22

Re: Restoring drive after using dd on it...

#23 2011-04-11 06:33:15

Re: Restoring drive after using dd on it...

Board footer