0

I used dd when I did a very dumb thing. Yes, I did override the wrong drive.

I run dd if=file_on_sdb1.iso of=/dev/sdb1 conv=fsync. (Please note: /dev/sdb1/ and not /dev/sdb!) It didn't run completely. I interrupted it after ~20s I guess. (It was connected via USB2.)

The device which was /dev/sdb then is a 1TB (~998GB) HDD USB disk. It is formatted with GPT. It contains one huge partition which takes up all the space. That one is formatted with ext4.

There was a lot (~50GB I guess) of data on there that I'd like to recover.

The file I used for overriding (file_on_sdb1.iso) was maybe ~2.5GB big. That means it probably didn't override everything. It's 20 times smaller, how could it?

What I know

  • the partition table is still there
  • I can't simply mount the hard drive (no usefull data)
  • the first superblock is destroyed

What I'd like to know

  • Does there (most likely) still exist one of old superblocks? (I can't believe that all the superblocks are overriden first. What would they do this for.)

Bonus points for tips for recovering the data.

Tim_Stewart
  • 6,041
Asqiir
  • 149

1 Answers1

1

Based on your information you can calculate the size of the overwritten area by approx. 45 MBytes/sec *20 sec= 900 MBytes, but not more than 2,5GByte.

You are wrong when stating:

It is formatted with GPT.

It is partitioned with GPT. Formating is referring to structuring a file system.

Testdisk should be able to find superblock backup information. That does not bring back your overwritten ~GByte but it could be possible that you will be able to extract parts of the filesystem.

Photorec as recommended by gronostaj does not provide you with file names and folder structure. Use this when Testdisk fails.

r2d3
  • 4,050