Arch Linux

roeleman

Member

Registered: 2007-11-09

Posts: 46

dd to /dev/sda instead of /dev/sdb, how to restore /dev/sda

Hello,

yesterday I made a mistake, I did a dd to /dev/sda:

dd if=imagefile.img of=/dev/sda

Problem is my /dev/sda is my harddisk and it should have been /dev/sdb (usbstick).

Now my computer doesn't boot anymore.

How can I restore my harddisk without losing my data?  The image file I copied was around 120MB. 

Did dd than only overwrite the first 120MB or is there more?

Regards,
Roel

mfa

Member

Registered: 2007-10-04

Posts: 19

Re: dd to /dev/sda instead of /dev/sdb, how to restore /dev/sda

Hey there!

Well that was quite a nasty mistake .
The first thing I would do if I was you, is to try backing up the complete harddisk you have written to. Meaning if you have a second hd available or something you should try to boot a linux live cd (e.g. archie) and back up /dev/sda (for example with dd if=/dev/sda of=/mnt/backup_drive/backup.bin or something similar). I would not try messing around with the harddisk without further backup, 'cause if another mistake is being made your chances to recover will shrink exponentially.

Then there are important questions: Was your system installed on a single partition or did you split up the harddisk into several partitions, like for instance one for the root filesystem / and one for /home? Have you ever backed up your partition table? Do you maybe remember your partition table exactly? What filesystem were you using?

Give some more information, this will help evaluating the possibilities.

Cheers,
mfa

roeleman

Member

Registered: 2007-11-09

Posts: 46

Re: dd to /dev/sda instead of /dev/sdb, how to restore /dev/sda

Hello,

thanks already for the respons.  Sadly, I didn't made partitions, normally I do it always but my arch install was a try but I liked it so much it became my nr.1 OS.  Never did a back-up (stupid I know), it  was a try... sadly, there is some important data on it(my girlfriends documents, I gave here a usb-stick to backup but she never did...).

Maybe something strange: I wasn't root when I did it, although the write was succesfull...  I have to search this out.  i will start with the backup and checking the filesystem with a live-cd.  It's not the first time I ruin my pc. 

regards,
Roel

mfa

Member

Registered: 2007-10-04

Posts: 19

Re: dd to /dev/sda instead of /dev/sdb, how to restore /dev/sda

Make sure you backup the right disk to the right one. Device names may differ if you add a harddrive and boot from a live cd. So double check everything ...

Well it will be kinda hard to recover if you have overwritten the first 120 MB of the disk. But if you were not root, how can this be that the write was successful? Is your user account uid=0 or have you done it with sudo or something?

Perhaps you should also try to google recovery options for the filesystem you used, maybe someone has already tried something similar like this...

Cheers,
mfa

Bebo

Member

From: Göteborg, Sweden

Registered: 2006-06-07

Posts: 207

Re: dd to /dev/sda instead of /dev/sdb, how to restore /dev/sda

I think I've read an article somewhere on a method to at least extract the data from a ruined partition (i.e. overwritten mbr and/or partition table). In the article I think the recovered data ended up in a lost+found directory and the file names where gone, but at least there were whole files. Unfortunately I've forgotten where I read it; if I'm able to find it I'll post a link here.

The data on the first 120 mb are gone since you overwrote that part, but the rest should be left on the harddrive, but the info on where the files and directories are have been lost.

I agree with previous posters though, backup the whole disk before you try anything.

Bebo

Member

From: Göteborg, Sweden

Registered: 2006-06-07

Posts: 207

Re: dd to /dev/sda instead of /dev/sdb, how to restore /dev/sda

Okay, I found _an_ article on this, not sure if it is the one I mentioned above. Check out http://www.linux.com/articles/56588 - but, that method will not work (at least not work well) on ReiserFS partitions, as mentioned in the comments. Also, you might have a look at Foremost (available in the AUR).

Last edited by Bebo (2008-03-09 20:57:21)

roeleman

Member

Registered: 2007-11-09

Posts: 46

Re: dd to /dev/sda instead of /dev/sdb, how to restore /dev/sda

Thank You guys,

my arch-linux is up and running again in aprox. 1,5h time!!
First I tried to backup the harddisk with knoppix and saw my harddisk was empty, in gparted it seemed like it was never used... I was down, down, down...  I didn't give up and downloaded systemrescuecd. Testdisk rstored my partition table and I saw it was my lucky day.  The first partition on my harddrive was SWAP.  All my files where intact and my stupid mistake only overwrote SWAP and MBR. 

Reinstall grub would do the trick, i thought... but it didn't.  Wy?  Testdisk allocated my partitions to hda1 and hda2.  In arch I had sda1 (swap); sda2 (/) and sda3 (/home).  Now when I reinstalled grub the partition table didn't correspond to the ona in arch.  A little bit fiddling in menu.lst, fstab and devices.map managed me to boot my arch system from fallback.  My normal boot doesn't work though, I already changed everything to the right partitions but it keeps complaining about not finding my root partition.  I already tried root=/dev/hda1; /sda1 and the whole rimram.
Can somebody tell me what's the problem?

It is probably my initrd file, isn't it?

Bebo

Member

From: Göteborg, Sweden

Registered: 2006-06-07

Posts: 207

Re: dd to /dev/sda instead of /dev/sdb, how to restore /dev/sda

Well, I can't say anything smart about the initrd, but it is probable that your partitions are named sda1 and sda2 in Arch (even though testdisk said hda1 and hda2).

That was quick (and lucky) though - congrats :)

roeleman

Member

Registered: 2007-11-09

Posts: 46

Re: dd to /dev/sda instead of /dev/sdb, how to restore /dev/sda

OK,

fixed everything.  In mkinitcpo.conf changed everything with pata to ide.  Made a new initrd (with mkinitcpo), after backing up the old one and everything works OK now.  Now my partitions in arch are named hda1 and hda2.  Lucky thing of al these problems is: I learned a lot and I can use hdparm now to speed up my drive (was not possibly ith sda disks and the disk was not on its highest performance as it was in my gentoo system).

Thanks guys!