Recovering contents of an external hard drive inadvertantly written over with dd command

Questions about applications and software
Forum rules
Before you post please read how to get help
Post Reply
julianvb
Level 4
Level 4
Posts: 483
Joined: Sat Dec 14, 2013 9:43 pm
Location: Virginia Beach, VA

Recovering contents of an external hard drive inadvertantly written over with dd command

Post by julianvb » Thu Jun 14, 2018 5:21 pm

2018-06-14

Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command? I should have first checked the destination external harddrive's ID. No wonder dd is nicknamed the deadly command. Thank you all in advance.
Julianvb
Last edited by julianvb on Thu Jun 14, 2018 5:35 pm, edited 2 times in total.
Julianvb: A (Kernel: 4.4.0-111-generic i686, LM18.3 Sylvia, 32-bit, Desktop Cinnamon 3.6.7, Atom N270 CPU, 2gb RAM, 64gb SSD)
B (Kernel: 4.10.0-38-generic i686, LM18.3 Sylvia, 32-bit, Desktop MATE 1.18.0, Atom N270 CPU, 2gb RAM, 64gb SSD)
.
.

User avatar
WharfRat
Level 20
Level 20
Posts: 11828
Joined: Thu Apr 07, 2011 8:15 pm

Re: Saving contents of an external hard drive inadvertantly written over with dd command

Post by WharfRat » Thu Jun 14, 2018 5:31 pm

I'm embarrassed to say that coincidentally I dd'd a Mint iso to my internal sdc device two months ago :oops:

The only recovery method that worked for me was from backups :wink:
ImageImage

rene
Level 8
Level 8
Posts: 2335
Joined: Sun Mar 27, 2016 6:58 pm

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by rene » Thu Jun 14, 2018 5:39 pm

julianvb wrote:
Thu Jun 14, 2018 5:21 pm
Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command?
If the destination disk/partition got completely overwritten, then no, period. If you conversely quickly noticed and hit Ctrl-C, if only the first part of the filesystem was destroyed, then the not themselves overwritten files may be recoverable with a filesystem-specific recovery tool. If in between (including if the source was smaller than the dest) then manual grepping through the device for particularly valuable data which may have been at the end could do; particularly for textual data.

julianvb
Level 4
Level 4
Posts: 483
Joined: Sat Dec 14, 2013 9:43 pm
Location: Virginia Beach, VA

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by julianvb » Thu Jun 14, 2018 6:07 pm

WharfRat and rene,
Thank you for quick responses. Can you elaborate on your recovery methods?
Julianvb
Julianvb: A (Kernel: 4.4.0-111-generic i686, LM18.3 Sylvia, 32-bit, Desktop Cinnamon 3.6.7, Atom N270 CPU, 2gb RAM, 64gb SSD)
B (Kernel: 4.10.0-38-generic i686, LM18.3 Sylvia, 32-bit, Desktop MATE 1.18.0, Atom N270 CPU, 2gb RAM, 64gb SSD)
.
.

rene
Level 8
Level 8
Posts: 2335
Joined: Sun Mar 27, 2016 6:58 pm

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by rene » Thu Jun 14, 2018 6:13 pm

Can you first elaborate on what you dd'ed to what? I.e., small file or a few zero blocks to a disk, to a partition, ...

As said, if the destination disk/device was fully overwritten, no recovery of any sort is possible, period; if not suggestions vary with what you did and for how long. Easiest is showing us the command you used; if with an if= parameter, together with a (size-) description of said if=.

julianvb
Level 4
Level 4
Posts: 483
Joined: Sat Dec 14, 2013 9:43 pm
Location: Virginia Beach, VA

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by julianvb » Thu Jun 14, 2018 6:22 pm

rene,
This is the command executed.

Code: Select all

dd if=lm17.3mate.iso of=/dev/sdb bs=4M  && sync 
I did not wake up to my blunder until it was too late.
Julian
Julianvb: A (Kernel: 4.4.0-111-generic i686, LM18.3 Sylvia, 32-bit, Desktop Cinnamon 3.6.7, Atom N270 CPU, 2gb RAM, 64gb SSD)
B (Kernel: 4.10.0-38-generic i686, LM18.3 Sylvia, 32-bit, Desktop MATE 1.18.0, Atom N270 CPU, 2gb RAM, 64gb SSD)
.
.

rene
Level 8
Level 8
Posts: 2335
Joined: Sun Mar 27, 2016 6:58 pm

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by rene » Thu Jun 14, 2018 6:45 pm

julianvb wrote:
Thu Jun 14, 2018 6:22 pm
I did not wake up to my blunder until it was too late.
Supposedly meaning that the command ran to completion. In any case, that means at most 2G or so at the start of the disk was overwritten which doesn't seem too bad. External drive you say: of what size? Supposedly had one big partition? If it was formatted NTFS I'd sooner advice a Windows forum: you'll likely find more people aware of NTFS tools over there.

If ext3 or ext4 we could try here; it's a complication if you don't remember the (fairly exact) partition layout, seeing as how the partition table got overwritten: you need a starting sector for the old filesystem to guess at backup superblocks. The partition table format was MBR? If GPT instead there's actually a backup at the end of the disk...

Noticing you may not be aware of the answers to these questions and may need an automated recovery tool. The only ones I'm aware of are TestDisk and PhotoRec: https://www.cgsecurity.org/wiki/TestDisk which are likely quite good. I personally however have experience mostly with more manual scrounging around; wait around a bit for further TestDisk/PhotoRec advise from other forum members if indeed you need an automated tool.

Even if not I'm afraid I need to quite desperately be in bed at the moment so I'm hoping someone can step in for now...

[EDIT] Let me only quickly add... the fact that you dd'ed the 17.3 ISO is in fact probably a complication in the sense of said ISO having a partition table itself. That is: something like TestDisk may not notice anything amiss with that table or at least not notice the original table was overwritten. As such you may in fact improve its chances at being helpful by overwriting the partition table once more. Making sure that "sdb" is still the external drive, dd if=/dev/zero of=/dev/sdb bs=512 count=1. This wouldn't make anything worse: the current first sector is bollocks anyway.
Last edited by rene on Thu Jun 14, 2018 7:05 pm, edited 1 time in total.

User avatar
WharfRat
Level 20
Level 20
Posts: 11828
Joined: Thu Apr 07, 2011 8:15 pm

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by WharfRat » Thu Jun 14, 2018 7:03 pm

julianvb wrote:
Thu Jun 14, 2018 6:07 pm
WharfRat and rene,
Thank you for quick responses. Can you elaborate on your recovery methods?
Julianvb
Well as I've already stated I had to restore the contents from backups.

I didn't see it feasible to try and restore individual files and file remnants with a disk recovery utility since there were thousands of them.

Something catastrophic like this certainly highlights the importance of maintaining comprehensive backups.
ImageImage

julianvb
Level 4
Level 4
Posts: 483
Joined: Sat Dec 14, 2013 9:43 pm
Location: Virginia Beach, VA

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by julianvb » Thu Jun 14, 2018 8:44 pm

WharfRat,dd
I agree with you completely. I think there's always a place for write-once read-only devices such as CDs for secure storage.
Julianvb
Julianvb: A (Kernel: 4.4.0-111-generic i686, LM18.3 Sylvia, 32-bit, Desktop Cinnamon 3.6.7, Atom N270 CPU, 2gb RAM, 64gb SSD)
B (Kernel: 4.10.0-38-generic i686, LM18.3 Sylvia, 32-bit, Desktop MATE 1.18.0, Atom N270 CPU, 2gb RAM, 64gb SSD)
.
.

User avatar
Faust
Level 4
Level 4
Posts: 438
Joined: Thu Jul 14, 2016 3:40 am

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by Faust » Fri Jun 15, 2018 9:07 am

julianvb wrote:
Thu Jun 14, 2018 5:21 pm
2018-06-14

Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command?
.....
This has been recommended to me by various people , but I've never needed to try it .

https://www.r-studio.com/free-linux-rec ... load.shtml

If all else fails , it might be worth a spin ..... nothing to lose really :)

Post back if you use it .... it would be good to get some feedback .
" And so it goes " - Kurt Vonnegut
The modern reality and the satirical parody are rapidly converging .

rene
Level 8
Level 8
Posts: 2335
Joined: Sun Mar 27, 2016 6:58 pm

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by rene » Fri Jun 15, 2018 3:34 pm

The immediately above is probably not too useful; an ext2/3/4 undelete utility first needs an ext2/3/4 filesystem to work on and in this case that filesystem itself is gone, not just files on it.

Did you try what TestDisk/PhotoRec say about things, the first again possibly after zeroing out its first sector?

User avatar
Spearmint2
Level 15
Level 15
Posts: 5748
Joined: Sat May 04, 2013 1:41 pm
Location: Maryland, USA

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by Spearmint2 » Fri Jun 15, 2018 3:54 pm

I had a failed USB flashdrive and I used GParted's inbuilt Data Recovery to get most of the files back off it. I had to examine the header in each (other than image files) to find proper file endings for some. I used a binhex editor in linux called "bless" for that. The image viewer showed all files that were images, even with REC file ending on them, so those were easy to change back.
All things go better with Mint. Mint julep, mint jelly, mint gum, candy mints, pillow mints, peppermint, chocolate mints, spearmint,....

User avatar
administrollaattori
Level 15
Level 15
Posts: 5646
Joined: Tue Sep 03, 2013 4:51 am
Location: Finland
Contact:

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by administrollaattori » Fri Jun 15, 2018 4:20 pm

julianvb wrote:
Thu Jun 14, 2018 5:21 pm
2018-06-14
Is there any way to recover the contents of an external hard drive I've just inadvertently written over with the dd command?
Yes from the sectors which are not dding.

Recovering files using R-Linux -> viewtopic.php?t=265582

julianvb
Level 4
Level 4
Posts: 483
Joined: Sat Dec 14, 2013 9:43 pm
Location: Virginia Beach, VA

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by julianvb » Fri Jun 15, 2018 6:04 pm

Hi, Everyone,
Thanks so much for your enthusiastic help and empathy. I am attaching a screenshot on my external hard drive, which was essentially a single HPFS/NTFS Microsoft Windows partition. I hope this new information makes it easer for you folks to help me.
Julianvb
250gb-exthdd.png
250gb-exthdd.png (68.7 KiB) Viewed 365 times
250gb-exthdd.png
250gb-exthdd.png (68.7 KiB) Viewed 365 times
Julianvb: A (Kernel: 4.4.0-111-generic i686, LM18.3 Sylvia, 32-bit, Desktop Cinnamon 3.6.7, Atom N270 CPU, 2gb RAM, 64gb SSD)
B (Kernel: 4.10.0-38-generic i686, LM18.3 Sylvia, 32-bit, Desktop MATE 1.18.0, Atom N270 CPU, 2gb RAM, 64gb SSD)
.
.

julianvb
Level 4
Level 4
Posts: 483
Joined: Sat Dec 14, 2013 9:43 pm
Location: Virginia Beach, VA

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by julianvb » Fri Jun 15, 2018 8:22 pm

Hi, rene,
I've just tried your dd suggestion

Code: Select all

 dd if=/dev/zero of=/dev/sdb   bs=512  count=1 
I am attaching the latest post-dd response from fdisk.
June15-postdd-fdisk.png
June15-postdd-fdisk.png (75.06 KiB) Viewed 357 times
Thanks very much again.



Julianvb
Julianvb: A (Kernel: 4.4.0-111-generic i686, LM18.3 Sylvia, 32-bit, Desktop Cinnamon 3.6.7, Atom N270 CPU, 2gb RAM, 64gb SSD)
B (Kernel: 4.10.0-38-generic i686, LM18.3 Sylvia, 32-bit, Desktop MATE 1.18.0, Atom N270 CPU, 2gb RAM, 64gb SSD)
.
.

User avatar
Flemur
Level 16
Level 16
Posts: 6271
Joined: Mon Aug 20, 2012 9:41 pm
Location: Potemkin Village

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by Flemur » Sat Jun 16, 2018 9:57 am

julianvb wrote:
Fri Jun 15, 2018 8:22 pm
I am attaching the latest post-dd response from fdisk.
Those images are ... almost .. unreadable. How about copying the text from the terminal and pasting it here inside "Code" brackets? ( = the "</>" directly above the forum text box you type into).
Please edit your original post title to include [SOLVED] if/when it is solved!
Your data and OS are backed up....right?
Mint 18.3 Xfce/fluxbox/pulse-less
Xubuntu 17.10/fluxbox/pulse-less

julianvb
Level 4
Level 4
Posts: 483
Joined: Sat Dec 14, 2013 9:43 pm
Location: Virginia Beach, VA

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by julianvb » Sat Jun 16, 2018 1:18 pm

fdisk-out.png
Flemur,
I hope the new image looks more readable. Thanks.

Julianvb
Last edited by julianvb on Sat Jun 16, 2018 2:18 pm, edited 2 times in total.
Julianvb: A (Kernel: 4.4.0-111-generic i686, LM18.3 Sylvia, 32-bit, Desktop Cinnamon 3.6.7, Atom N270 CPU, 2gb RAM, 64gb SSD)
B (Kernel: 4.10.0-38-generic i686, LM18.3 Sylvia, 32-bit, Desktop MATE 1.18.0, Atom N270 CPU, 2gb RAM, 64gb SSD)
.
.

rene
Level 8
Level 8
Posts: 2335
Joined: Sun Mar 27, 2016 6:58 pm

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by rene » Sat Jun 16, 2018 1:22 pm

julianvb wrote:
Fri Jun 15, 2018 8:22 pm
I've just tried your dd suggestion

Code: Select all

 dd if=/dev/zero of=/dev/sdb   bs=512  count=1 
Your initial display for /dev/sdb is unexpected since if you dd'ed the Linux Mint 17.3 ISO to /dev/sdb it seems you'd need to be shown a "valid" (for the ISO) partition table on /dev/sdb whereas you are showing a fully garbled one. Still, not important I guess. Nor, really, the subsequent zeroing out of the partition table as per above: it would've improved TestDisk chances of being helpful, but given the information that the drive was a 1-partition NTFS drive I'd suggest to (for now) stop with Linux-based recovery attempts anyway and switch to an NTFS-specific tool, probably available only on Windows.

As to which NTFS recovery tool I'd have no suggestion; Google finds many of them but I have experience with none. Maybe others here will, but chances are better in Windows surroundings.

Do note though that you should be able to recover most. With less than 2G overwritten, certainly in the case of ext4 it would be a matter of pointing the mount command at a backup-superblock rather than the main one at the start to get access again. Remainder then consists only of checking that actual file-data is undamaged for the important files. This is clearly easier if the drive is a, say, video-drive, where perhaps just one or two individual files were overwritten as part of that 2G than when the drive contains lots of small files, but still, you should be able to retrieve most of it.

I'd now go on the lookout for an NTFS recovery tool and/or people to assist me with using it.

julianvb
Level 4
Level 4
Posts: 483
Joined: Sat Dec 14, 2013 9:43 pm
Location: Virginia Beach, VA

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by julianvb » Sat Jun 16, 2018 1:54 pm

rene,
Thanks for pointing me to the right direction. I'll try to look for NTFS hard-disk recovery tools. You've taught me much.
Julianvb
Julianvb: A (Kernel: 4.4.0-111-generic i686, LM18.3 Sylvia, 32-bit, Desktop Cinnamon 3.6.7, Atom N270 CPU, 2gb RAM, 64gb SSD)
B (Kernel: 4.10.0-38-generic i686, LM18.3 Sylvia, 32-bit, Desktop MATE 1.18.0, Atom N270 CPU, 2gb RAM, 64gb SSD)
.
.

User avatar
all41
Level 13
Level 13
Posts: 4946
Joined: Tue Dec 31, 2013 9:12 am
Location: Computer, Car, Cage

Re: Recovering contents of an external hard drive inadvertantly written over with dd command

Post by all41 » Sat Jun 16, 2018 4:02 pm

Have a look at Easus Partition Wizard:
https://www.easeus.com/partition-recovery/
You can scan to find out what can be recovered for free, but to
do the actual recovery requires the 69.95 paid version.
Prepare for a lengthy process for both scanning and recovery (overnight or longer for larger drives)
With many partition recovery apps files can often be recovered but will not necessarily have recognizable
names or attributes. Good luck in your recovery.
Proud to be a supporter and monthly contributor to Mint.

Post Reply

Return to “Software & Applications”