Recover from unintended dd

[Kalpa Welivitigoda]

Hi all,

I wanted to create a live install media from by flash drive using dd.
Following is the command I used,

sudo dd bs=4M if=Fedora-Live-Desktop-x86_64-19-1.iso of=/dev/sdc1

The sad part is /dev/sdc1 happened to be my external hard disk (I wanted to
write the image to my flash disk), this was by mistake.

Now I cannot access files in my external hard disk. My hard disk is 1TB and
had only one partition. With this dd now it has two partitions (sdc1 and
sdc2), following are the outputs of trying to mount them,

$ sudo mount /dev/sdc1 abc/
mount: mount /dev/sdc1 on /tmp/abc failed: Structure needs cleaning

$ sudo mount /dev/sdc2 abc/
mount: /dev/sdc2 is write-protected, mounting read-only
mount: wrong fs type, bad option, bad superblock on /dev/sdc2,
       missing codepage or helper program, or other error

In some cases useful info is found in syslog - try
       dmesg | tail or so.

I googled for the issue and read that it is hard to recover.

Have any of you experienced a similar situation and recovered?

Any help/clue to get the hard disk recovered is highly appreciated.

[Sam Varshavchik]

Kalpa Welivitigoda writes:
> Hi all,
>
> I wanted to create a live install media from by flash drive using dd.  
> Following is the command I used,
>
> sudo dd bs=4M if=Fedora-Live-Desktop-x86_64-19-1.iso of=/dev/sdc1
>
> The sad part is /dev/sdc1 happened to be my external hard disk (I wanted to  
> write the image to my flash disk), this was by mistake.
>
> Now I cannot access files in my external hard disk. My hard disk is 1TB and  
> had only one partition. With this dd now it has two partitions (sdc1 and  
> sdc2), following are the outputs of trying to mount them,
>
> $ sudo mount /dev/sdc1 abc/
> mount: mount /dev/sdc1 on /tmp/abc failed: Structure needs cleaning
>
> $ sudo mount /dev/sdc2 abc/
> mount: /dev/sdc2 is write-protected, mounting read-only
> mount: wrong fs type, bad option, bad superblock on /dev/sdc2,
>        missing codepage or helper program, or other error
>
> In some cases useful info is found in syslog - try
>        dmesg | tail or so.
>
> I googled for the issue and read that it is hard to recover.
>
> Have any of you experienced a similar situation and recovered?
>
> Any help/clue to get the hard disk recovered is highly appreciated.

dd overwrote the destination block device. The old data on the disk is gone.  
It is no more. It ceased to the exist. Went to the great bit bucket in the  
sky. It is ex-data.

[fred roller]

On Mon, Nov 21, 2016 at 6:30 AM, Sam Varshavchik 
wrote:
> Any help/clue to get the hard disk recovered is highly appreciated.
> >

For a full recovery you can research some advance software which *may*
rebuild.  The names escape me atm but it does exists and you need to be
comfortable with some advanced knowledge; or pay for a service.  The other
solution is to install "testdisk" which has a program called "photorec" and
let it grab what files it can.  Though designed to recover pics it will
recover most coherent files it recognizes, which is quite a bit. The caveat
is that it will have no structure and the filenames will be gone.  You will
have file extensions to identify most but you will have the data to
rebuild/rename by hand.  Question becomes: How important is the data?
Otherwise, as Sam pointed out, the disk is roached and
re-partitioning/reformatting is in order with lessons learned.

-- Fred

[William Oliver]

On Mon, 2016-11-21 at 07:26 -0500, fred roller wrote:
> On Mon, Nov 21, 2016 at 6:30 AM, Sam Varshavchik <mrsam@courier-mta.c
> om> wrote:
> > > Any help/clue to get the hard disk recovered is highly
> > > appreciated.
>
> For a full recovery you can research some advance software which
> *may* rebuild.  The names escape me atm but it does exists and you
> need to be comfortable with some advanced knowledge; or pay for a
> service.  The other solution is to install "testdisk" which has a
> program called "photorec" and let it grab what files it can.  Though
> designed to recover pics it will recover most coherent files it
> recognizes, which is quite a bit. The caveat is that it will have no
> structure and the filenames will be gone.  You will have file
> extensions to identify most but you will have the data to
> rebuild/rename by hand.  Question becomes: How important is the
> data?  Otherwise, as Sam pointed out, the disk is roached and re-
> partitioning/reformatting is in order with lessons learned.
>
> -- Fred

_______________________________________________

Yeah, I went through this about 10 years ago.  Tools have 
changed since then, of course, but as I remember, I used 
testdisk and something called the "Trinity Rescue Kit."  I don't
 know if it's still around. I had mostly trashed images for a court
case I was working on.  I got about 70% of my data back, and it 
took me many hours of looking at files by hand.

There's also extundelete.  I don't know if it will work when 
the entire filesystem has been trashed, but it may be worth
a try.

Lessons learned is right.

rsync is your friend.  Now that storage has become so cheap, I always
maintain two backups of my data -- one I carry with me on a portable 
hard drive, and the other I keep locked up at home.

billo

[Robert Nichols]

On 11/20/2016 11:52 PM, Kalpa Welivitigoda wrote:
> Hi all,
>
> I wanted to create a live install media from by flash drive using dd.
> Following is the command I used,
>
> sudo dd bs=4M if=Fedora-Live-Desktop-x86_64-19-1.iso of=/dev/sdc1
>
> The sad part is /dev/sdc1 happened to be my external hard disk (I wanted
> to write the image to my flash disk), this was by mistake.
>
> Now I cannot access files in my external hard disk. My hard disk is 1TB
> and had only one partition. With this dd now it has two partitions (sdc1
> and sdc2), following are the outputs of trying to mount them,

First, why are you doing _anything_ with a badly out-of-date and 
unsupported Fedora 19?

Second, I think you must have written to /dev/sdc and not /dev/sdc1,
since writing to the _partition_ /dev/sdc1 should not have affected the 
partition table on /dev/sdc.

Whatever was on the first ~1 GB (997 MB) of your disk is gone forever. 
Much of the rest should be recoverable, but that depends on what 
filesystem was used. You should start by running testdisk to recover the 
original partitioning. You can download SystedRescueCD from 
http://www.system-rescue-cd.org/SystemRescueCd_Homepage, which 
includes testdisk and a host of other useful recovery tools. Hopefully, 
testdisk can discover the remains of your original filesystem. Once the 
partition table is restored, a filesystem-specific fsck (e.g., 
fsck.ext4) should restore sanity to the filesystem, though much of the 
content will likely end up in lost+found. That should include intact 
subdirectories with file names, but some content will end up as 
anonymous files.