• Recover partition and data from dd'ed drive


    This newbie mistake was made a few months ago, before I was on Antergos, but while I was testing several distros. So I kept the HD until now, so I could figure out how to recover it.

    While testing Linux distros, the process was get the ISO, dd’it to a usb pen and boot on the desktop or laptop.

    So, the rookie error was, I did the DD command on a 2TB hard drive, when I should it done on the USB.

    The HD had a 2TB partition, maybe ext4 (not sure yet) and it was written with 1.7 GB more or less on the first sectors of the HD, as the DD command behaves, it write the ISO directly on the first sectors.

    So except from the first 1.7GB, the data is still there, but no partition is recognized or any data.

    I’ve started recovering yesterday with TestDisk 7.0 and on the first scan, detects nothing; on second deeper pass, it detects a partition on a backup sector or something like that, and there are options to add partition, show files, etc. I pressed enter and it went to the start menu, without writting anything.

    I’m scanning again, as with 2TB takes a few hours for each pass.

    What I want to know is, if any of you have already recovered data from a HD that was wiped with DD.

    Before:
    +---------------------------------------------------------------------+
    | 2TB ext4 partition with data files and documents                    |
    +---------------------------------------------------------------------+
    
    After DD mistake:
    +------------------------+--------------------------------------------+
    | 1.7GB DD overwrite ISO | still have data from old partition         |
    +------------------------+--------------------------------------------+
    

    Thank you.
    cas

  • you will need to have a second drive to copy files from the issued disk…
    B.T.W.: dd is an abbreviation for “Destroy Disk”.

    as you overwrite the disk informations recovery will need a bit of luck…

    [updates once a week] = [90% less problems]
    antergos:_rescue
    how to add system logs:
    wget http://bit.ly/2GCG9k2 && sh 2GCG9k2
    :handshake: donate antergos

  • @joekamprad said in Recover partition and data from dd'ed drive:

    https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    Great catch mate! It says what I have done without reading anything.

    Anyway, good news is that after 2 days, I managed to get my files out. It’s copying now to a 1TB HD but only a selected directory. But most important is that did a deep search on those menus and it found a NTFS backup partition. How cool is that?

    Wrote the backup partition info on the TestDisk menus, and it found the files. I still don’t know how many and if all are ok, but I managed to get one directory out to another disk.

    So it’s a big copy operation, so tomorrow I’ll give more news.

    It takes like 6 or more to scan the entire 2TB on a Sata3. I really don’t know how much because I leave it here and come back. But after 4 full scans, found how to write and see my files.

    And “destruction disk” it’s almost true. I did mistake when I was getting my hands on all distros I could find, maybe before found the Arch distros.

    I just wish I read that link before doing this. It’s this part:

    "NTFS Boot sector recovery

    The boot sector of the first partition named Partition 1 is still damaged. It’s time to fix it. The status of the NTFS boot sector is bad and the backup boot sector is valid. Boot sectors are not identical. "

    That’s what it finds in the deeper search.

    Anyway, I think I might miss a few files, but I will recover maybe 98% or more.

    Thanks @joekamprad

  • If it is running it will recover mostly everything!

    You will need to be patient, it will take a real livespan !

    [updates once a week] = [90% less problems]
    antergos:_rescue
    how to add system logs:
    wget http://bit.ly/2GCG9k2 && sh 2GCG9k2
    :handshake: donate antergos

partition29 recover4 data4 dded1 Posts 5Views 270
Log in to reply
Bloom Email Optin Plugin

Looks like your connection to Antergos Community Forum was lost, please wait while we try to reconnect.