misuse command dd, how to recover

[cheng chen]

Hi all,

I just input a wrong output device file of the dd command

it should be "dd if=xxx.iso of=/dev/sdc"

but I input "dd if=xxx.iso of=/dev/sdb",

so my hard disk partition is ruined. The xxx.iso is just 3GB, but I have
400GB data in the disk which means other data are still there.
Is there anything I can do to get the files back to me. It's partition type
is NTFS.

Thank

-- 
Cheng(誠)

My Page: http://freakrobot.blogbus.com/

[cheng chen]

Thank you for you all. I used "dd & hexedit" to fix the MBR. And then with
disk recovery software I gain most of files back.
It makes me thrilled. Thanks again.

On Mon, Feb 7, 2011 at 6:08 AM, Hiisi <hiisi(a)fedoraproject.org&gt; wrote:

>  su, 2011-02-06 kello 10:41 -0600, Richard Shaw kirjoitti:
>  > You overwrote a lot more than the partition table but I have had luck
>  > with testdisk in the past. It's available on System Rescue CD, or in
>  > the fedora repos if you still have a bootable system.
>  >
>  >
>
>  I also vote for testdisk. However when I used it recently I had no luck
>  with version provided by fedora (testdisk-6.11-6). So, I contacted
>  Christophe Grenier (testdisk developer) and he suggested me to try
>  TestDisk 6.12-WIP:
>  wget -N http://www.cgsecurity.org/testdisk-6.12-WIP.linux26.tar.bz2
>  tar xjf testdisk-6.12-WIP.linux26.tar.bz2
>  cd testdisk-6.12-WIP
>  sudo ./testdisk_static
>  HTC
>  --
>  If Bill Gates is the Devil then Linus Torvalds must be the Messiah.
>         -- Unknown source
>
>  --
>  users mailing list
>  users(a)lists.fedoraproject.org
>  To unsubscribe or change subscription options:
>  https://admin.fedoraproject.org/mailman/listinfo/users
>  Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>  


-- 
Cheng(誠)

Fedora Project Contributor -- Ambassador
https://fedoraproject.org/wiki/User:Freakrobot
_______________________________________________

My Page: http://freakrobot.blogbus.com/

[Hiisi]

su, 2011-02-06 kello 10:41 -0600, Richard Shaw kirjoitti:
>  You overwrote a lot more than the partition table but I have had
> luck
>  with testdisk in the past. It's available on System Rescue CD, or in
>  the fedora repos if you still have a bootable system.
>  
>   
I also vote for testdisk. However when I used it recently I had no luck
with version provided by fedora (testdisk-6.11-6). So, I contacted
Christophe Grenier (testdisk developer) and he suggested me to try
TestDisk 6.12-WIP:
wget -N http://www.cgsecurity.org/testdisk-6.12-WIP.linux26.tar.bz2
tar xjf testdisk-6.12-WIP.linux26.tar.bz2
cd testdisk-6.12-WIP
sudo ./testdisk_static
HTC
-- 
If Bill Gates is the Devil then Linus Torvalds must be the Messiah.
	-- Unknown source

[Richard Shaw]

On Sun, Feb 6, 2011 at 9:20 AM, cheng chen <freakrobot(a)acm.org&gt; wrote:
>  Hi all,
>
>  I just input a wrong output device file of the dd command
>
>  it should be "dd if=xxx.iso of=/dev/sdc"
>
>  but I input "dd if=xxx.iso of=/dev/sdb",
>
>  so my hard disk partition is ruined. The xxx.iso is just 3GB, but I have
>  400GB data in the disk which means other data are still there.
>  Is there anything I can do to get the files back to me. It's partition type
>  is NTFS. 
You overwrote a lot more than the partition table but I have had luck
with testdisk in the past. It's available on System Rescue CD, or in
the fedora repos if you still have a bootable system.

It worked to recover my NTFS partition but I only overwrode the
partition, not the data.

Richard

[Konstantin Svist]

On 02/06/2011 07:20 AM, cheng chen wrote:
>  Hi all,
>
>  I just input a wrong output device file of the dd command
>
>  it should be "dd if=xxx.iso of=/dev/sdc"
>
>  but I input "dd if=xxx.iso of=/dev/sdb",
>
>  so my hard disk partition is ruined. The xxx.iso is just 3GB, but I 
>  have 400GB data in the disk which means other data are still there.
>  Is there anything I can do to get the files back to me. It's partition 
>  type is NTFS.
>
>  Thank
>
>  -- 
>  Cheng(誠)
>
>  My Page: http://freakrobot.blogbus.com/
>  
In the past, I've had success recovering files using Ontrack 
EasyRecoverey software. In your case it wouldn't magically make the 
partition alive again, but let you copy files that hadn't been 
overwritten to another location.
Another option is to send in your HDD for a data recovery service - but 
companies usually charge even more for that.

[Marko Vojinovic]

On Sunday 06 February 2011 15:20:53 cheng chen wrote:
>  I just input a wrong output device file of the dd command
>  
>  it should be "dd if=xxx.iso of=/dev/sdc"
>  
>  but I input "dd if=xxx.iso of=/dev/sdb",
>  
>  so my hard disk partition is ruined. The xxx.iso is just 3GB, but I have
>  400GB data in the disk which means other data are still there.
>  Is there anything I can do to get the files back to me. It's partition type
>  is NTFS. 
I'm afraid that doing the above overwrote the partition table on /dev/sdb, and 
I know no way of accessing the data on the drive if there is no partition 
information available. The fact that the filesystem is NTFS only makes matters 
worse.

If you have an additional empty hard disk which is *identical* (in size, 
geometry, type, etc) to /dev/sdb disk, and if you know the exact sizes of 
partitions which were present on /dev/sdb, you might try recreating the 
identical partition layout on that spare drive (say, /dev/sdd), and then do 
something like:

dd if=/dev/sdd of=/dev/sdb bs=512 count=1

That will (hopefully) restore at least the partition information on the 
/dev/sdb drive. After that, you might consider accessing the data that were 
not corrupted somehow (though I'm not sure how --- some file recovery utility, 
preferably Windows-centric since the filesystem is NTFS, or something similar). 
Someone else might give you some useful suggestions on that part.

But all that is a longshot at best. The only other course of action you can 
take now is to start swearing and cursing for not making regular backups of 
that drive when you had the chance... ;-)

Btw, I know how you feel, I also had a few slips of a finger when using dd, 
before I learned to double- and triple-check the syntax of every dd command I 
type as root. And I also don't do it so often these days anymore... :-)

HTH, :-)
Marko