I "dd"ed a wrong partition and now I am trying to save my 1TB data

atm · 2011-07-12 04:59:28

Guys, I wrote an ISO to /dev/sdb1 (My 1TB HD) instead of /dev/sdc1 (8GB pendrive I was trying to make bootable). I ^Ced the copying process when I got to know about it, but I had already lost my HD's partition table by then.

So, now I have a 1TB external with no partition table (overwritten by the data in the ISO).

# fdisk -l
Disk /dev/sdb: 1000.2 GB, 1000204884992 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953525166 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x4d17d56f

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *          63  1953520064   976760001    7  HPFS/NTFS/exFAT

On connecting, I can see contents of the ISO in Dolphin (Not sure if they are copied entirely, not that I even care. I just want my data back!

On using Testdisk, I can see most of the contents of the 1TB, but I cannot recover them all (I should because they haven't been altered as such.)

Anyway for me to rewrite my partition table?

EDIT: It's an NTFS partition

Last edited by atm (2011-07-12 07:12:24)

lilsirecho · 2011-07-12 05:14:54

Perhaps you defined what you did with ....dd command....incorrectly.

When using the DD command for installing an .iso, you must use the following:

dd -if=(full path to input .iso) of=/dev/sd(x)..... The output file (of=) cannopt be a partition but must be the full drive ID....just sda or sdb,,,,,,sd(x).

From what you have stated, the .iso should not have loaded.

It sometimes causes trouble when it is incorrectly used and it wipes out partitions. This may have occured on your system.

If so, its history.

atm · 2011-07-12 05:21:17

^I know it was a command line fail. And the ISO did load, at least partially.

But, obviously I did not write the entire disk. I guess I should be able to retrieve most of the data, using some tool I don't know of (yet).

lilsirecho · 2011-07-12 05:24:34

Perhaps google for repair of damaged HDD....there are some out there.

EDIT: DD stands for Definitely Dangerous...................

Last edited by lilsirecho (2011-07-12 05:27:41)

atm · 2011-07-12 05:31:24

lilsirecho wrote:

Perhaps google for repair of damaged HDD....there are some out there.

I have been doing it for the past 20hours. I thought someone else must have had a situation like me.

EDIT: DD stands for Definitely Dangerous...................

True.

hauzer · 2011-07-12 06:30:49

lilsirecho wrote:

EDIT: DD stands for Definitely Dangerous...................

Data Destroyer

EDIT: I had a similar situation, only difference being that it was a NTFS partition. I had used Partition Wizard, it scanned the HD, found the lost partitions and recreated the partition table. Don't know how will this help you, though.

Last edited by hauzer (2011-07-12 06:32:27)

gazj · 2011-07-12 06:54:22

install testdisk. It contains two programs testdisk and photorec, it is great at recovering partitions and files.

http://www.cgsecurity.org/wiki/TestDisk

atm · 2011-07-12 07:13:55

hauzer wrote:

I had a similar situation, only difference being that it was a NTFS partition. I had used Partition Wizard, it scanned the HD, found the lost partitions and recreated the partition table. Don't know how will this help you, though.

I can't believe I did not mention the partition type. It's NTFS. I am trying Partition Wizard now.

gazj wrote:

install testdisk. It contains two programs testdisk and photorec, it is great at recovering partitions and files.
http://www.cgsecurity.org/wiki/TestDisk

Photorec won't work. It refuses to detect the half-corrupt drive.

EDIT AGAIN: Damn. It's working now! Weird. Thanks!

Last edited by atm (2011-07-12 07:39:46)

Awebb · 2011-07-12 08:43:41

https://bbs.archlinux.org/viewtopic.php?id=114095

ntfsundelete in the ntfsprogs package. It recovered more data than I lost in the process :-D

Last edited by Awebb (2011-07-12 08:44:16)

steve_v · 2011-07-12 09:25:32

First $iso_size of disk overwritten = no primary parition table etc. use testdisk to recover. Then run the appropriate fsck on the recovered partition.

My flatmate accidentaly added a data drive to an onboard controller (dmraid) array, we actually got most of the data off of it and testdisk even worked _while_ the controller was in the process of overwriting the disk.

@2c

Steve.

atm · 2011-07-12 13:35:41

Awebb wrote:

https://bbs.archlinux.org/viewtopic.php?id=114095
ntfsundelete in the ntfsprogs package. It recovered more data than I lost in the process :-D

Lol. I am not sure if it would work on a partition with corrupt table. Anyway, testdisk is recovering most of my files (around 50%). After that, I would try ntfsdelete.

steve_v wrote:

First $iso_size of disk overwritten = no primary parition table etc. use testdisk to recover. Then run the appropriate fsck on the recovered partition.
My flatmate accidentaly added a data drive to an onboard controller (dmraid) array, we actually got most of the data off of it and testdisk even worked _while_ the controller was in the process of overwriting the disk.

Another option. I am going to have a sleepless night trying this one and the ntfsdelete

dunc · 2011-07-12 20:03:22

I did something similar a couple of years back (there should be a thread around here somewhere). After recovering everything with testdisk, and discovering that it doesn't (or didn't at the time) recover filenames, I thought I'd give good ol' fsck a try. And it worked, mostly. A few truncated files, as I recall, but not nearly as many as I expected, and all of the important stuff was intact.

Mind you, if I remember correctly, I had only formatted the partition, not overwritten any of it. And it was ext3. I suspect fsck isn't so hot on NTFS...

atm · 2011-07-13 13:31:21

Ok. I used TestDisk to recover ~200G of my data (though I think there was more that could have been recovered, only if I needed all that)

I couldn't recover my songs and videos folder which suggests the older folders got overwritten (Songs and videos were made before any other folder on that HD)

EDIT: How do I close this topic?

Last edited by atm (2011-07-13 13:33:20)

lilsirecho · 2011-07-13 14:40:03

Go to first post and use edit to include solved in the topic window...

Arch Linux

#1 2011-07-12 04:59:28

I "dd"ed a wrong partition and now I am trying to save my 1TB data

#2 2011-07-12 05:14:54

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#3 2011-07-12 05:21:17

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#4 2011-07-12 05:24:34

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#5 2011-07-12 05:31:24

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#6 2011-07-12 06:30:49

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#7 2011-07-12 06:54:22

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#8 2011-07-12 07:13:55

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#9 2011-07-12 08:43:41

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#10 2011-07-12 09:25:32

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#11 2011-07-12 13:35:41

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#12 2011-07-12 20:03:22

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#13 2011-07-13 13:31:21

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

#14 2011-07-13 14:40:03

Re: I "dd"ed a wrong partition and now I am trying to save my 1TB data

Board footer