ive nuked my external hard drive

newme360 · 2022-10-27 19:40:37

hi all,

i'm new to the forum and generally new to linux. tonight i was trying to write an iso to a usb but as it turned out i wrote the iso to the hard drive. i was using dd and i had heard to be careful to select the right volume but here we are. i suspect the files are still on the hard drive though they dont show up.

if more information helps im using arch with the xfce de. the hard drive is a wd external hdd.

any help in pointing me in the right direction to get my files back would be appreciated.

thanks

david

cfr · 2022-10-27 19:47:57

https://wiki.archlinux.org/title/File_recovery

newme360 · 2022-10-27 20:05:41

thanks very much

i read through that page, one thing that i still don't understand entirely is, does dd remove everything from the drive or does it remove the pathway to the file. as in is there any point in trying to use the programs in the page?

i should also ask is how much risk is there?

Last edited by newme360 (2022-10-27 20:21:06)

V1del · 2022-10-27 20:35:53

dd overwrites whatever is at the start of the device to the point where the image is complete, So whatever was stored in the first 700MB (or whatever was the size of the iso) of the disk will be gone, there's still hope for the rest of it.

What risk are you afraid of? For most standard and practical purposes outside of these tools you already destroyed the relevant contents. Unless you flub the device path while using recovery tools they are pretty much your only realistic chance. I'd generally be safer - if you have the storage for it elsewhere - to pull a image of the drive so you can operate on the image

Last edited by V1del (2022-10-27 20:38:38)

seth · 2022-10-27 20:36:31

dd doesn't remove anything - it writes bytes from a source to a destination.
The bytes that were in the destination before are now replaced.

So if your iso was 1GB, the first GB of the device (drive or partition) you named as destination are now the iso - everything else remains untouched, but the data that was stored on those blocks is now gone.
Unfortunately, the head of a partition contains most of the filesystem data that organizes the data on your partition - you can try to recover that from an alternative superblock, but I'd not hold my breath.

W/o the filesystem, what is reasonably recoverable depends on the fragmentation of the filesystem - testdisk and photorec can detect certain data chunks as "files of a type" and restore them for you, but the bigger the files are/were the more they will be scattered around the device and the individual parts only look like random meaningless bytes.

Any attempt to write to the compromised drive is almost guaranteed to destroy more data, so before you try to reconstruct the filesystem, you should have an image of the compromised device backed up and you need to recover files w/ testdisk/photorec to a different drive.

newme360 · 2022-10-27 21:02:24

thank you

i've installed testdisk but don't have another hard drive so ill have to order one.

lfitzgerald · 2022-10-28 00:05:49

You don't need to use dd to write the ISO btw. You can just use cat. https://unix.stackexchange.com/q/12532

seth · 2022-10-28 06:01:15

You can also use sed or awk … none of which would have saved the user from friting to the wrong device.
And also https://porkmail.org/era/unix/award#cat

lfitzgerald · 2022-10-29 09:13:41

seth wrote:

You can also use sed or awk … none of which would have saved the user from friting to the wrong device.
And also https://porkmail.org/era/unix/award#cat

Yes, but the simpler interface might make it easier to prevent mistakes in the future. Incidentally the same reason people do "useless" use of cat.

seth · 2022-10-29 12:10:19

Feel free to explain how a supposidly simpler interface will prevent you from writing into /dev/sdb instead of /dev/sda because you didn't pay attention to the device order.
People for the most part tend to abuse cat because they don't know any better.

lfitzgerald · 2022-10-30 21:36:38

It will make it easier to pay attention, since you're not getting distracted by a less familiar interface.

seth wrote:

People for the most part tend to abuse cat because they don't know any better.

In that case, now that you've linked to the page, everyone in this thread surely knows better, and is free to (ab)use cat if they so wish.

Last edited by lfitzgerald (2022-10-30 21:37:05)

PerfMonk · 2022-10-31 02:02:31

That's time to check if you have good backups!

Arch Linux

#1 2022-10-27 19:40:37

ive nuked my external hard drive

#2 2022-10-27 19:47:57

Re: ive nuked my external hard drive

#3 2022-10-27 20:05:41

Re: ive nuked my external hard drive

#4 2022-10-27 20:35:53

Re: ive nuked my external hard drive

#5 2022-10-27 20:36:31

Re: ive nuked my external hard drive

#6 2022-10-27 21:02:24

Re: ive nuked my external hard drive

#7 2022-10-28 00:05:49

Re: ive nuked my external hard drive

#8 2022-10-28 06:01:15

Re: ive nuked my external hard drive

#9 2022-10-29 09:13:41

Re: ive nuked my external hard drive

#10 2022-10-29 12:10:19

Re: ive nuked my external hard drive

#11 2022-10-30 21:36:38

Re: ive nuked my external hard drive

#12 2022-10-31 02:02:31

Re: ive nuked my external hard drive

Board footer