Recovering contents of an external hard drive inadvertantly written over with dd command
Forum rules
Before you post read how to get help. Topics in this forum are automatically closed 6 months after creation.
Before you post read how to get help. Topics in this forum are automatically closed 6 months after creation.
Recovering contents of an external hard drive inadvertantly written over with dd command
2018-06-14
Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command? I should have first checked the destination external harddrive's ID. No wonder dd is nicknamed the deadly command. Thank you all in advance.
Julianvb
Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command? I should have first checked the destination external harddrive's ID. No wonder dd is nicknamed the deadly command. Thank you all in advance.
Julianvb
Last edited by LockBot on Wed Dec 28, 2022 7:16 am, edited 3 times in total.
Reason: Topic automatically closed 6 months after creation. New replies are no longer allowed.
Reason: Topic automatically closed 6 months after creation. New replies are no longer allowed.
Re: Saving contents of an external hard drive inadvertantly written over with dd command
I'm embarrassed to say that coincidentally I dd'd a Mint iso to my internal sdc device two months ago
The only recovery method that worked for me was from backups
The only recovery method that worked for me was from backups
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
If the destination disk/partition got completely overwritten, then no, period. If you conversely quickly noticed and hit Ctrl-C, if only the first part of the filesystem was destroyed, then the not themselves overwritten files may be recoverable with a filesystem-specific recovery tool. If in between (including if the source was smaller than the dest) then manual grepping through the device for particularly valuable data which may have been at the end could do; particularly for textual data.
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
WharfRat and rene,
Thank you for quick responses. Can you elaborate on your recovery methods?
Julianvb
Thank you for quick responses. Can you elaborate on your recovery methods?
Julianvb
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
Can you first elaborate on what you dd'ed to what? I.e., small file or a few zero blocks to a disk, to a partition, ...
As said, if the destination disk/device was fully overwritten, no recovery of any sort is possible, period; if not suggestions vary with what you did and for how long. Easiest is showing us the command you used; if with an if= parameter, together with a (size-) description of said if=.
As said, if the destination disk/device was fully overwritten, no recovery of any sort is possible, period; if not suggestions vary with what you did and for how long. Easiest is showing us the command you used; if with an if= parameter, together with a (size-) description of said if=.
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
rene,
This is the command executed.
I did not wake up to my blunder until it was too late.
Julian
This is the command executed.
Code: Select all
dd if=lm17.3mate.iso of=/dev/sdb bs=4M && sync
Julian
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
Supposedly meaning that the command ran to completion. In any case, that means at most 2G or so at the start of the disk was overwritten which doesn't seem too bad. External drive you say: of what size? Supposedly had one big partition? If it was formatted NTFS I'd sooner advice a Windows forum: you'll likely find more people aware of NTFS tools over there.
If ext3 or ext4 we could try here; it's a complication if you don't remember the (fairly exact) partition layout, seeing as how the partition table got overwritten: you need a starting sector for the old filesystem to guess at backup superblocks. The partition table format was MBR? If GPT instead there's actually a backup at the end of the disk...
Noticing you may not be aware of the answers to these questions and may need an automated recovery tool. The only ones I'm aware of are TestDisk and PhotoRec: https://www.cgsecurity.org/wiki/TestDisk which are likely quite good. I personally however have experience mostly with more manual scrounging around; wait around a bit for further TestDisk/PhotoRec advise from other forum members if indeed you need an automated tool.
Even if not I'm afraid I need to quite desperately be in bed at the moment so I'm hoping someone can step in for now...
[EDIT] Let me only quickly add... the fact that you dd'ed the 17.3 ISO is in fact probably a complication in the sense of said ISO having a partition table itself. That is: something like TestDisk may not notice anything amiss with that table or at least not notice the original table was overwritten. As such you may in fact improve its chances at being helpful by overwriting the partition table once more. Making sure that "sdb" is still the external drive,
dd if=/dev/zero of=/dev/sdb bs=512 count=1
. This wouldn't make anything worse: the current first sector is bollocks anyway.
Last edited by rene on Thu Jun 14, 2018 7:05 pm, edited 1 time in total.
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
Well as I've already stated I had to restore the contents from backups.
I didn't see it feasible to try and restore individual files and file remnants with a disk recovery utility since there were thousands of them.
Something catastrophic like this certainly highlights the importance of maintaining comprehensive backups.
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
WharfRat,dd
I agree with you completely. I think there's always a place for write-once read-only devices such as CDs for secure storage.
Julianvb
I agree with you completely. I think there's always a place for write-once read-only devices such as CDs for secure storage.
Julianvb
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
This has been recommended to me by various people , but I've never needed to try it .
https://www.r-studio.com/free-linux-rec ... load.shtml
If all else fails , it might be worth a spin ..... nothing to lose really
Post back if you use it .... it would be good to get some feedback .
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
The immediately above is probably not too useful; an ext2/3/4 undelete utility first needs an ext2/3/4 filesystem to work on and in this case that filesystem itself is gone, not just files on it.
Did you try what TestDisk/PhotoRec say about things, the first again possibly after zeroing out its first sector?
Did you try what TestDisk/PhotoRec say about things, the first again possibly after zeroing out its first sector?
- Spearmint2
- Level 16
- Posts: 6900
- Joined: Sat May 04, 2013 1:41 pm
- Location: Maryland, USA
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
I had a failed USB flashdrive and I used GParted's inbuilt Data Recovery to get most of the files back off it. I had to examine the header in each (other than image files) to find proper file endings for some. I used a binhex editor in linux called "bless" for that. The image viewer showed all files that were images, even with REC file ending on them, so those were easy to change back.
All things go better with Mint. Mint julep, mint jelly, mint gum, candy mints, pillow mints, peppermint, chocolate mints, spearmint,....
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
Hi, Everyone,
Thanks so much for your enthusiastic help and empathy. I am attaching a screenshot on my external hard drive, which was essentially a single HPFS/NTFS Microsoft Windows partition. I hope this new information makes it easer for you folks to help me.
Julianvb
Thanks so much for your enthusiastic help and empathy. I am attaching a screenshot on my external hard drive, which was essentially a single HPFS/NTFS Microsoft Windows partition. I hope this new information makes it easer for you folks to help me.
Julianvb
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
Hi, rene,
I've just tried your dd suggestion
I am attaching the latest post-dd response from fdisk. Thanks very much again.
Julianvb
I've just tried your dd suggestion
Code: Select all
dd if=/dev/zero of=/dev/sdb bs=512 count=1
Julianvb
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
Those images are ... almost .. unreadable. How about copying the text from the terminal and pasting it here inside "Code" brackets? ( = the "</>" directly above the forum text box you type into).
Please edit your original post title to include [SOLVED] if/when it is solved!
Your data and OS are backed up....right?
Your data and OS are backed up....right?
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
I hope the new image looks more readable. Thanks.
Julianvb
Last edited by julianvb on Sat Jun 16, 2018 2:18 pm, edited 2 times in total.
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
Your initial display for /dev/sdb is unexpected since if you dd'ed the Linux Mint 17.3 ISO to /dev/sdb it seems you'd need to be shown a "valid" (for the ISO) partition table on /dev/sdb whereas you are showing a fully garbled one. Still, not important I guess. Nor, really, the subsequent zeroing out of the partition table as per above: it would've improved TestDisk chances of being helpful, but given the information that the drive was a 1-partition NTFS drive I'd suggest to (for now) stop with Linux-based recovery attempts anyway and switch to an NTFS-specific tool, probably available only on Windows.julianvb wrote: ⤴Fri Jun 15, 2018 8:22 pm I've just tried your dd suggestionCode: Select all
dd if=/dev/zero of=/dev/sdb bs=512 count=1
As to which NTFS recovery tool I'd have no suggestion; Google finds many of them but I have experience with none. Maybe others here will, but chances are better in Windows surroundings.
Do note though that you should be able to recover most. With less than 2G overwritten, certainly in the case of ext4 it would be a matter of pointing the mount command at a backup-superblock rather than the main one at the start to get access again. Remainder then consists only of checking that actual file-data is undamaged for the important files. This is clearly easier if the drive is a, say, video-drive, where perhaps just one or two individual files were overwritten as part of that 2G than when the drive contains lots of small files, but still, you should be able to retrieve most of it.
I'd now go on the lookout for an NTFS recovery tool and/or people to assist me with using it.
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
rene,
Thanks for pointing me to the right direction. I'll try to look for NTFS hard-disk recovery tools. You've taught me much.
Julianvb
Thanks for pointing me to the right direction. I'll try to look for NTFS hard-disk recovery tools. You've taught me much.
Julianvb
Re: Recovering contents of an external hard drive inadvertantly written over with dd command
Have a look at Easus Partition Wizard:
https://www.easeus.com/partition-recovery/
You can scan to find out what can be recovered for free, but to
do the actual recovery requires the 69.95 paid version.
Prepare for a lengthy process for both scanning and recovery (overnight or longer for larger drives)
With many partition recovery apps files can often be recovered but will not necessarily have recognizable
names or attributes. Good luck in your recovery.
https://www.easeus.com/partition-recovery/
You can scan to find out what can be recovered for free, but to
do the actual recovery requires the 69.95 paid version.
Prepare for a lengthy process for both scanning and recovery (overnight or longer for larger drives)
With many partition recovery apps files can often be recovered but will not necessarily have recognizable
names or attributes. Good luck in your recovery.
Everything in life was difficult before it became easy.