misuse command dd, how to recover

[Marko Vojinovic]

On Sunday 06 February 2011 15:20:53 cheng chen wrote:
> I just input a wrong output device file of the dd command
> 
> it should be "dd if=xxx.iso of=/dev/sdc"
> 
> but I input "dd if=xxx.iso of=/dev/sdb",
> 
> so my hard disk partition is ruined. The xxx.iso is just 3GB, but I have
> 400GB data in the disk which means other data are still there.
> Is there anything I can do to get the files back to me. It's partition type
> is NTFS.

I'm afraid that doing the above overwrote the partition table on /dev/sdb, and 
I know no way of accessing the data on the drive if there is no partition 
information available. The fact that the filesystem is NTFS only makes matters 
worse.

If you have an additional empty hard disk which is *identical* (in size, 
geometry, type, etc) to /dev/sdb disk, and if you know the exact sizes of 
partitions which were present on /dev/sdb, you might try recreating the 
identical partition layout on that spare drive (say, /dev/sdd), and then do 
something like:

dd if=/dev/sdd of=/dev/sdb bs=512 count=1

That will (hopefully) restore at least the partition information on the 
/dev/sdb drive. After that, you might consider accessing the data that were 
not corrupted somehow (though I'm not sure how --- some file recovery utility, 
preferably Windows-centric since the filesystem is NTFS, or something similar). 
Someone else might give you some useful suggestions on that part.

But all that is a longshot at best. The only other course of action you can 
take now is to start swearing and cursing for not making regular backups of 
that drive when you had the chance... ;-)

Btw, I know how you feel, I also had a few slips of a finger when using dd, 
before I learned to double- and triple-check the syntax of every dd command I 
type as root. And I also don't do it so often these days anymore... :-)

HTH, :-)
Marko