Recovering contents of an external hard drive inadvertantly written over with dd command

[julianvb]

2018-06-14

Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command? I should have first checked the destination external harddrive's ID. No wonder dd is nicknamed the deadly command. Thank you all in advance.
Julianvb

[WharfRat]

I'm embarrassed to say that coincidentally I dd'd a Mint iso to my internal sdc device two months ago

The only recovery method that worked for me was from backups

[rene]

Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command?

If the destination disk/partition got completely overwritten, then no, period. If you conversely quickly noticed and hit Ctrl-C, if only the first part of the filesystem was destroyed, then the not themselves overwritten files may be recoverable with a filesystem-specific recovery tool. If in between (including if the source was smaller than the dest) then manual grepping through the device for particularly valuable data which may have been at the end could do; particularly for textual data.

[julianvb]

WharfRat and rene,
Thank you for quick responses. Can you elaborate on your recovery methods?
Julianvb

[rene]

Can you first elaborate on what you dd'ed to what? I.e., small file or a few zero blocks to a disk, to a partition, ...

As said, if the destination disk/device was fully overwritten, no recovery of any sort is possible, period; if not suggestions vary with what you did and for how long. Easiest is showing us the command you used; if with an if= parameter, together with a (size-) description of said if=.

[julianvb]

rene,
This is the command executed.

Code: Select all

dd if=lm17.3mate.iso of=/dev/sdb bs=4M  && sync 

I did not wake up to my blunder until it was too late.
Julian

[rene]

I did not wake up to my blunder until it was too late.

Supposedly meaning that the command ran to completion. In any case, that means at most 2G or so at the start of the disk was overwritten which doesn't seem too bad. External drive you say: of what size? Supposedly had one big partition? If it was formatted NTFS I'd sooner advice a Windows forum: you'll likely find more people aware of NTFS tools over there.

If ext3 or ext4 we could try here; it's a complication if you don't remember the (fairly exact) partition layout, seeing as how the partition table got overwritten: you need a starting sector for the old filesystem to guess at backup superblocks. The partition table format was MBR? If GPT instead there's actually a backup at the end of the disk...

Noticing you may not be aware of the answers to these questions and may need an automated recovery tool. The only ones I'm aware of are TestDisk and PhotoRec: https://www.cgsecurity.org/wiki/TestDisk which are likely quite good. I personally however have experience mostly with more manual scrounging around; wait around a bit for further TestDisk/PhotoRec advise from other forum members if indeed you need an automated tool.

Even if not I'm afraid I need to quite desperately be in bed at the moment so I'm hoping someone can step in for now...

[EDIT] Let me only quickly add... the fact that you dd'ed the 17.3 ISO is in fact probably a complication in the sense of said ISO having a partition table itself. That is: something like TestDisk may not notice anything amiss with that table or at least not notice the original table was overwritten. As such you may in fact improve its chances at being helpful by overwriting the partition table once more. Making sure that "sdb" is still the external drive, dd if=/dev/zero of=/dev/sdb bs=512 count=1. This wouldn't make anything worse: the current first sector is bollocks anyway.

[WharfRat]

WharfRat and rene,
Thank you for quick responses. Can you elaborate on your recovery methods?
Julianvb

Well as I've already stated I had to restore the contents from backups.

I didn't see it feasible to try and restore individual files and file remnants with a disk recovery utility since there were thousands of them.

Something catastrophic like this certainly highlights the importance of maintaining comprehensive backups.

[julianvb]

WharfRat,dd
I agree with you completely. I think there's always a place for write-once read-only devices such as CDs for secure storage.
Julianvb

[Faust]

2018-06-14

Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command?
.....

This has been recommended to me by various people , but I've never needed to try it .

https://www.r-studio.com/free-linux-rec ... load.shtml

If all else fails , it might be worth a spin ..... nothing to lose really

Post back if you use it .... it would be good to get some feedback .

[rene]

The immediately above is probably not too useful; an ext2/3/4 undelete utility first needs an ext2/3/4 filesystem to work on and in this case that filesystem itself is gone, not just files on it.

Did you try what TestDisk/PhotoRec say about things, the first again possibly after zeroing out its first sector?

[Spearmint2]

I had a failed USB flashdrive and I used GParted's inbuilt Data Recovery to get most of the files back off it. I had to examine the header in each (other than image files) to find proper file endings for some. I used a binhex editor in linux called "bless" for that. The image viewer showed all files that were images, even with REC file ending on them, so those were easy to change back.

[kukamuumuka]

2018-06-14
Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command?

Yes from the sectors which are not dding.

Recovering files using R-Linux -> viewtopic.php?t=265582

[julianvb]

Hi, Everyone,
Thanks so much for your enthusiastic help and empathy. I am attaching a screenshot on my external hard drive, which was essentially a single HPFS/NTFS Microsoft Windows partition. I hope this new information makes it easer for you folks to help me.
Julianvb

250gb-exthdd.png

250gb-exthdd.png

[julianvb]

Hi, rene,
I've just tried your dd suggestion

Code: Select all

 dd if=/dev/zero of=/dev/sdb   bs=512  count=1 

I am attaching the latest post-dd response from fdisk.

June15-postdd-fdisk.png

Thanks very much again.



Julianvb

[Flemur]

I am attaching the latest post-dd response from fdisk.

Those images are ... almost .. unreadable. How about copying the text from the terminal and pasting it here inside "Code" brackets? ( = the "</>" directly above the forum text box you type into).

[julianvb]

fdisk-out.png

Flemur,
I hope the new image looks more readable. Thanks.

Julianvb

[rene]

I've just tried your dd suggestion

Code: Select all

 dd if=/dev/zero of=/dev/sdb   bs=512  count=1 

Your initial display for /dev/sdb is unexpected since if you dd'ed the Linux Mint 17.3 ISO to /dev/sdb it seems you'd need to be shown a "valid" (for the ISO) partition table on /dev/sdb whereas you are showing a fully garbled one. Still, not important I guess. Nor, really, the subsequent zeroing out of the partition table as per above: it would've improved TestDisk chances of being helpful, but given the information that the drive was a 1-partition NTFS drive I'd suggest to (for now) stop with Linux-based recovery attempts anyway and switch to an NTFS-specific tool, probably available only on Windows.

As to which NTFS recovery tool I'd have no suggestion; Google finds many of them but I have experience with none. Maybe others here will, but chances are better in Windows surroundings.

Do note though that you should be able to recover most. With less than 2G overwritten, certainly in the case of ext4 it would be a matter of pointing the mount command at a backup-superblock rather than the main one at the start to get access again. Remainder then consists only of checking that actual file-data is undamaged for the important files. This is clearly easier if the drive is a, say, video-drive, where perhaps just one or two individual files were overwritten as part of that 2G than when the drive contains lots of small files, but still, you should be able to retrieve most of it.

I'd now go on the lookout for an NTFS recovery tool and/or people to assist me with using it.

[julianvb]

rene,
Thanks for pointing me to the right direction. I'll try to look for NTFS hard-disk recovery tools. You've taught me much.
Julianvb

[all41]

Have a look at Easus Partition Wizard:
https://www.easeus.com/partition-recovery/
You can scan to find out what can be recovered for free, but to
do the actual recovery requires the 69.95 paid version.
Prepare for a lengthy process for both scanning and recovery (overnight or longer for larger drives)
With many partition recovery apps files can often be recovered but will not necessarily have recognizable
names or attributes. Good luck in your recovery.