0

I used dd to make a backup of an SD card, and went on to run chkdsk on it. Of course, chkdsk ended up removing all folders and moving all files to FOUND.000 and FOUND.001, renaming them to FILExxx.CHK to make it even harder to figure out what kind of file it is.

Thankfully, I have a backup! Or so I thought, until I pressed the up arrow and the enter key in quick succession - my keyboard actually registered two presses of the up arrow (it does this occasionally, but up until now I didn't want to replace it just because of this), and so I ended up running the "backup" command again. I quickly cancelled it, but dd still truncated the file from its original ~60GB to a few MB. To prevent further damage, I immediately remounted the backup drive as read-only.

Can I recover the "full length backup" somehow? Will setting the file size to the full size of the card using a tool like fallocate or something similar work? Do I have to look through all 15000 *.CHK files by myself?

The filesystem on the card was FAT32, in case that helps. The backup file itself was stored on a drive formatted with NTFS.

user819709
  • 1

1 Answers1

1

Using DD might work, but most likely won't. The difficulty is fragmentation - DD won't know how the underlying blocks the file used are linked.

You are getting into the area of $$$ experts here, so depending on the value of the data it might make sense to go to a data recovery expert, but assuming thats not on the cards -

I would be inclined to make a bit copy of the drive, and try recovery on that. You might be able to recover a fair chunk of the filesystem by using a mirror of the MFT. Although the answer to a different question - have a look at Is is possible to restore the MFT of a NTFS partition after a format? - as the steps you might want to take could be substantially similar.

davidgo
  • 73,366