looking to reverse a BIG mistake with dd command

CPUnltd · 2010-06-21 05:16:57

I think I may have used the dd command on the wrong disk drive... how do I reverse the function (if it's even possible)?

NOTE: as this thread has been revived from more than a few months ago, please refer to reply #13 to see where it is "picked up" from, as the posts prior to that point will not be as relevant.

Last edited by CPUnltd (2011-01-18 16:05:20)

ngoonee · 2010-06-21 05:27:11

Restore from back-up. You could try re-building the partition table, but that would only work AFAIK for data which is past the region affected by dd.

First things first, mount the drive read-only and make a disk image of the whole thing, work on that disk image instead of the original drive.

CPUnltd · 2010-06-21 18:44:57

what tools would I use to try to recover the drive? would archiving the drive (with fsarchiver or part image) do the trick, or would I need to do a low level clone of the drive (possibly with dd or something along those lines)... this is a good excuse to buy a new 1TB drive (so I can move stuff from the current 500GB and 250GB drives I have and end up with a drive empty that I can clone to and play with... I'm just not sure how valuable the stuff on the drive in question was... I don't remember what was on it... but I'd rather try and fail then not try at all...

Peanut · 2010-06-21 22:21:22

CPUnltd wrote:

what tools would I use to try to recover the drive?

If some of the partitions are partially destroyed (=no metadata), I recommend Foremost. It is a data carving tool developed by the US Air Force, and basically does a low-level search for internal data structures on the harddrive, and tries to recover your files based on that.

CPUnltd · 2010-06-22 02:41:39

is there an AUR package for Foremost? can't say I know Arch well enough to install much of anything from outside the repos...

IgnorantGuru · 2010-06-22 02:50:43

I can't recommend these personally as I've never had occasion to try them, but they were recommended to me...

http://www.cgsecurity.org/wiki/TestDisk
http://www.cgsecurity.org/wiki/PhotoRec

They are supposed to be included on System Rescue Live CD so you don't need to compile...
http://www.sysresccd.org/Main_Page

And also on other live CDs
http://www.cgsecurity.org/wiki/TestDisk_Livecd

Oh and I see an AUR...
http://www.archlinux.org/packages/?q=testdisk

Last edited by IgnorantGuru (2010-06-22 02:52:33)

Peanut · 2010-06-22 03:18:51

CPUnltd wrote:

is there an AUR package for Foremost?

Seems like there is

CPUnltd · 2010-07-23 21:17:00

ok, I have foremost installed, but have NO CLUE how to use it. I don't see any documentation on the website either, so how do I find out how to use this tool? (I've just screwed up for a second time and deleted my entire video library)...

seems like I make this screw up every time I have to reinstall something on one of my systems. I always have my external drives connected when I don't realize I do... sigh.........

jdn06 · 2010-07-23 22:25:14

Doc on foremost here:
http://linux.die.net/man/1/foremost

karol · 2010-07-24 10:19:41

CPUnltd wrote:

ok, I have foremost installed, but have NO CLUE how to use it. I don't see any documentation on the website either, so how do I find out how to use this tool? (I've just screwed up for a second time and deleted my entire video library)...

seems like I make this screw up every time I have to reinstall something on one of my systems. I always have my external drives connected when I don't realize I do... sigh.........

The first think to learn when you learn to ride a bike is learn how to fall from a bike - and not get yourself hurt. Yes, I'm speaking from experience.
Please take note of the www.die.net address - lot's of valuable info there.

If you did this again, I'd think that you've learned from experience and have an off-site backup. Making mistakes is OK, not learning from those mistakes is not.

Was that drive NTFS-formatted?

CPUnltd · 2010-07-24 17:30:16

actually, it's ext3

... my flaw is trying to do "important work" when I'm tired. I always end up installing arch when I'm tired and destracted ... needing to DD a flash drive with the current ISO that I use for multiple purposes.

this particular time, I DD'd the drive about 3 times before I realized that I was working on the wrong drive... no more working when I'm tired...

... the first order of business is checking that I'm awake and alert followed by making sure my systems are disconnected from everything uimportant for the work I'm about to do. Off-site is not really an option because this is all home-based stuff at the moment. My drives are in docking stations, so the most "offsite" I can do is removing the drives themselves from the stations. ...but thank you for the suggestion.

karol · 2010-07-24 17:36:04

> ... the first order of business is checking that I'm awake and alert
Sounds like you need sth like http://gmailblog.blogspot.com/2008/10/n … later.html

You can check out https://www.dropbox.com/pricing or similar services.

CPUnltd · 2011-01-18 16:03:05

I know this thread is really old, but I never fixed this issue and have just now started attempting to work on this drive again now that I have a new 2TB drive to work on recovery with... so please don't flag this thread because it's revived from so long ago... the issue isn't solved yet.

Her'e my current question... since chances are whatever was on the first 700MB of this drive are lost, could I use DD to copy something AFTER that point into a folder on the 2TB drive? My hope is that by using DD to copy from say 701MB to 800MB to /x/y/z that all the files in that area of the drive would be copied to the location in quesiton (or does DD only handle copying to a file? if so, I could specify a file, mount that file and move items from the file to the physical drive, right?) Just doing some final experimentation of my options because photrec recovered most everything on the reformatted drive after the Arch iso, but recovered all my videos in pieces as opposed to actual files I'm sure that whatever is at the beginning of this list of files getting recovered will be a broken or corrupted file, but I'm more concerned about all the rest of it, as I'm sure whatever I recover in pieces I most likely can re-download, unless they are pictures I temporarily stored on that drive... if I'm screwed on that note, then I'm screwed on that note. I know I've lost whatever is in the actual location of where the Arch ISO is, because of the number of times I dd'd the ISO onto the drive... whatever was there has to be permenantly overwritten by now.. but the rest is still "untouched" and invisible.

How can I use DD to start copying from the block or space after the end of the ISO? Which would probably be translating MB amounts with block size amounts... but I'm not entirely sure and there is no good reference I can find via google at this point. ANY leads would help at this point.

Last edited by CPUnltd (2011-01-18 16:03:33)

perbh · 2011-01-18 19:51:37

Would've been a good idea, but I'll doubt it will work - for the simple reason that you most certainly have overwritten the 'table-of-content', ie the topmost levels of your filesystem. The only remedy that I can think of is if there is a utility that will be able to recognize a directory node and then follow that through to the end - then do the same for the next etc etc.
I believe that what you will find is that a lot of the file-content - per ce - is intact, but not the file-nodes - and then that wont get you very far ... node-entries and directory-entries are the same but for a single bit ...
Personally I don't know of any such utility, but if you google - you might find some ...

CPUnltd · 2011-01-18 20:50:30

it's a start... part of me wonders what would happen if I tried manually creating a partition table with the drive label I origionally had... testdisk can see the old table (it shows the old disk label) but treats it as if it's already formatted to that (basically refuses to recover something it doesn't consider lost) so that makes me wonder...

Spacenick · 2011-01-18 22:00:52

You could try a google search for extundelete, assuming you use an ext filesystem

CPUnltd · 2011-01-18 22:33:32

I did use an ext3 filesystem and I have seen extundelete in the AUR repo, but didn't see much on how to use it... will check that out, thanks!

hellnest · 2011-01-19 04:56:02

have you try "dd_rescue"?

CPUnltd · 2011-01-19 19:44:08

I have not tried any dd variants as of yet, because I don't know what block to start at after the arch ISO so that I can attempt to extract the "hidden" files...

FarmerF · 2011-01-20 08:56:27

I recently had great succes with ext3grep. There is a standard package for it so just

pacman -S ext3grep

It has a lot of options but I found the most reliable thing to just restore everything and delete what you don't need. It should work on a backup image directly so just

ext3grep --restore-all /home/image.iso

Just be sure to have enough space in your current directory to save the output.

Last edited by FarmerF (2011-01-20 08:57:08)

CPUnltd · 2011-01-21 07:01:14

good info, FarmerF... but I'm curious, does it restore the info in the ISO WITHIN the ISO, or to the folder you're inside of? Would I be better off, say accessing a 1TB drive and using the ext3grep program from within a 2TB drive or should I dd the 1TB drive to backup.img on the 2TB drive, mount backup.img and ext3grep inside of backup.img?

Hope that was straightforward enough, cause reading back on it, it looks slightly confusing...

Arch Linux

#1 2010-06-21 05:16:57

looking to reverse a BIG mistake with dd command

#2 2010-06-21 05:27:11

Re: looking to reverse a BIG mistake with dd command

#3 2010-06-21 18:44:57

Re: looking to reverse a BIG mistake with dd command

#4 2010-06-21 22:21:22

Re: looking to reverse a BIG mistake with dd command

#5 2010-06-22 02:41:39

Re: looking to reverse a BIG mistake with dd command

#6 2010-06-22 02:50:43

Re: looking to reverse a BIG mistake with dd command

#7 2010-06-22 03:18:51

Re: looking to reverse a BIG mistake with dd command

#8 2010-07-23 21:17:00

Re: looking to reverse a BIG mistake with dd command

#9 2010-07-23 22:25:14

Re: looking to reverse a BIG mistake with dd command

#10 2010-07-24 10:19:41

Re: looking to reverse a BIG mistake with dd command

#11 2010-07-24 17:30:16

Re: looking to reverse a BIG mistake with dd command

#12 2010-07-24 17:36:04

Re: looking to reverse a BIG mistake with dd command

#13 2011-01-18 16:03:05

Re: looking to reverse a BIG mistake with dd command

#14 2011-01-18 19:51:37

Re: looking to reverse a BIG mistake with dd command

#15 2011-01-18 20:50:30

Re: looking to reverse a BIG mistake with dd command

#16 2011-01-18 22:00:52

Re: looking to reverse a BIG mistake with dd command

#17 2011-01-18 22:33:32

Re: looking to reverse a BIG mistake with dd command

#18 2011-01-19 04:56:02

Re: looking to reverse a BIG mistake with dd command

#19 2011-01-19 19:44:08

Re: looking to reverse a BIG mistake with dd command

#20 2011-01-20 08:56:27

Re: looking to reverse a BIG mistake with dd command

#21 2011-01-21 07:01:14

Re: looking to reverse a BIG mistake with dd command

Board footer