Recover stupid mistake

[Bryn M. Reeves]

On 05/27/2010 02:07 PM, Bruno Wolff III wrote:
> On Thu, May 27, 2010 at 13:32:51 +0100,
>   Mike Martin <redtux1 at googlemail.com> wrote:
>> Hi when I was trying (and failing) to get a bootable pen-drive, with
>> the F13 live image I accidentally did the following
>>
>> dd if=/dev/zero of=/dev/sdb bs=512 count=1
>>
>> which returned nearly immediately and now I have no data on the disk.
>>
>> The disk is 750 gig , of which about 400 is used. I am hoping that
>> only the partition table is gone, if not is there any way to recover
>> from my disaster
> 
> I believe that command just changed the first 512 bytes. If you know how
> it was partitioned you can probably get things back by making a new
> partition table.

You should have the size information for the partitions still present in
/proc/partitions (as long as nobody rebooted after running the dd or
tried to reread the partition table).

You'll probably want to run fdisk with units of sectors ('u' from main
menu) and remember that the values reported in partitions are 1k blocks
(i.e. two sectors for most disks).

If you're having trouble finding the right starting offset then you can
also take a look at parted's rescue command which will scan storage
looking for things that look like partitions (e.g. fs superblocks) and
then offers to create partition table entries for them.

Regards,
Bryn.