Disaster! I used 'dd' on the wrong drive! :(

atriya · 2010-08-11 14:14:37

I was using 'dd' to write the arch installation image to a usb drive, but I used /dev/sdc instead of /dev/sdb by mistake. sdc was a connected external hard disk, which got totally overwritten! I lost gigs of important stuff! Does anyone know of any way to undo this? Any help will be deeply appreciated. Thanks.

ablepharus · 2010-08-11 14:16:22

I guess, there is no way to do so. You'd need a undo button for you life

karol · 2010-08-11 14:21:42

http://www.gnu.org/software/ddrescue/ddrescue.html
Google for "disc recovery" or "file recovery".

Ashren · 2010-08-11 14:44:07

dd is an abbreviation for "Destroy Disk".

I don't think you'll get that data back.

Sorry.

Ranguvar · 2010-08-11 14:52:21

I very, very highly doubt you will be able to get back the first 700MiB (or whatever the size of the image you dd'ed) of that drive.

It MAY be possible to get back the rest. I wish you the best of luck in doing so!

KlavKalashj · 2010-08-11 14:59:44

I did the same thing two years ago, on a 500gb drive filled with music/movies and irreplaceable photos. I noticed it after a only a few seconds, still I got nothing back.

atriya · 2010-08-11 15:02:42

Well, ddrescue isn't working. It's just recovering the contents of the arch image I (mistakenly) wrote. That's only 103 MB. I don't care if I lose the first 103 MB! I had around 140 gigs on that drive.

tom5760 · 2010-08-11 15:26:24

Like others said, it may be possible to get back some stuff past the data that you wrote, but it will probably be difficult. Hopefully, you'll keep backups of important stuff from now on!

Andy Mack · 2010-08-11 15:35:49

I feel for you mate, horrible thing to happen. I lost 60gig of music doing something similar to you, I could have cried!

I've used recuva before and that worked great although it is windows only, wont get back what you overwrit? with arch image but possible the rest.

It gets easier

hiciu · 2010-08-11 16:11:28

atriya wrote:

Well, ddrescue isn't working. It's just recovering the contents of the arch image I (mistakenly) wrote. That's only 103 MB. I don't care if I lose the first 103 MB! I had around 140 gigs on that drive.

ddrescue won't help, it's just tweaked dd used when you have damaged cd drive, or your dvd disk is scratched, etc.
Did you had any partitions on that drive? If yes, then only first one (if it was bigger than 103MB) is damaged.
Anyway, try with testdisk, i'm sure you will be able to recover some stuff from that drive (i've successful recovered files from formatted ntfs partition using it). If you have enought space on other drives do dd if=/dev/damaged of=backup.img and use testdisk on backup.img. Don't write anything on /dev/damaged.

extra/testdisk 6.11.3-3 [2,38 MB]
    Checks and undeletes partitions + PhotoRec, signature based recovery tool

Last edited by hiciu (2010-08-11 16:13:18)

Bregol · 2010-08-11 16:24:22

ddrescue will just clone the drive. It is useful when doing computer forensics so that you do your work on a image of the drive rather than the drive itself.

Anything overwritten will not really be recoverable. But like has been said, that will only be a jumpdrive sized amount of your data. The important thing is to not keep using that partition because if you keep writing to that partition, you will keep writing over data you probably want to try to save. Which is one reason forensics is usually done on an image rather than the drive itself. That way there is always a clean copy to work on in case it gets written to or something bad happens.

That said, testdisk's photorec will probably allow you to scrape some of the data out. I believe it is classified as a data carver. I have used it before to recover stuff deleted from jump drives accidentally. It will search through the partition and look for headers of files and pull out the files. I dont think it will preserve the file names and folders and so forth, so you will have to go through what it pulls and figure out what is what.

Another tool I played with once is SleuthKit/Autopsy. I know some livecds come with that on it, such as Backtrack. Its a little harder to use than photorec but capable of a little more.

atriya · 2010-08-11 16:24:50

testdisk is analyzing the drive as I type. Keeping my fingers crossed.

atriya · 2010-08-11 17:15:37

So... the disk had two partitions on it, and (as hicui noted) only the first one was damaged. The good news is that I was able to undelete the entire second partition with testdisk. No damage was done to it whatsoever. testdisk preserved my file names, directory structure - worked like magic! The bad news is that all the important data was on the first partition. Looking into it now.

Last edited by atriya (2010-08-11 17:17:26)

atriya · 2010-08-11 18:38:58

MAGIC! I did the deep search for lost partitions with testdisk and it detected my damaged first partition from a 'backup boot sector' (or so it said), and recovered it! Of course, the parts that were overwritten by the 103MB will be damaged, but now I can browse the files, and most of them are fine! Now, the disk was pretty fragmented, so many files could have corrupted bits. But still, I never expected that I would recover so much! Yay!

ewaller · 2010-08-11 19:51:12

Congratulations :-)

Back it up -- now!

Remember, it isn't really backed up unless there are 2 copies, one of which is off-site.

Acecero · 2010-08-11 20:29:59

Ashren wrote:

dd is an abbreviation for "Destroy Disk".
I don't think you'll get that data back.
Sorry.

According to Wikipedia, dd is an abbreviation for "Data Description."

Though it has been jokingly called "Disk Destroyer" because of what happens when you use "dd on the wrong drive."

LookTJ · 2010-08-18 23:17:51

What about testdisk? It worked well for its purpose when I used it.

Inxsible · 2010-08-19 00:24:13

LookTJ wrote:

What about testdisk? It worked well for its purpose when I used it.

I think if you read the thread you will notice that the op did use testdisk

https://bbs.archlinux.org/viewtopic.php … 82#p807382

also atriya, please mark your thread as solved so it may be of use to others as well.

Arch Linux

#1 2010-08-11 14:14:37

Disaster! I used 'dd' on the wrong drive! :(

#2 2010-08-11 14:16:22

Re: Disaster! I used 'dd' on the wrong drive! :(

#3 2010-08-11 14:21:42

Re: Disaster! I used 'dd' on the wrong drive! :(

#4 2010-08-11 14:44:07

Re: Disaster! I used 'dd' on the wrong drive! :(

#5 2010-08-11 14:52:21

Re: Disaster! I used 'dd' on the wrong drive! :(

#6 2010-08-11 14:59:44

Re: Disaster! I used 'dd' on the wrong drive! :(

#7 2010-08-11 15:02:42

Re: Disaster! I used 'dd' on the wrong drive! :(

#8 2010-08-11 15:26:24

Re: Disaster! I used 'dd' on the wrong drive! :(

#9 2010-08-11 15:35:49

Re: Disaster! I used 'dd' on the wrong drive! :(

#10 2010-08-11 16:11:28

Re: Disaster! I used 'dd' on the wrong drive! :(

#11 2010-08-11 16:24:22

Re: Disaster! I used 'dd' on the wrong drive! :(

#12 2010-08-11 16:24:50

Re: Disaster! I used 'dd' on the wrong drive! :(

#13 2010-08-11 17:15:37

Re: Disaster! I used 'dd' on the wrong drive! :(

#14 2010-08-11 18:38:58

Re: Disaster! I used 'dd' on the wrong drive! :(

#15 2010-08-11 19:51:12

Re: Disaster! I used 'dd' on the wrong drive! :(

#16 2010-08-11 20:29:59

Re: Disaster! I used 'dd' on the wrong drive! :(

#17 2010-08-18 23:17:51

Re: Disaster! I used 'dd' on the wrong drive! :(

#18 2010-08-19 00:24:13

Re: Disaster! I used 'dd' on the wrong drive! :(

Board footer