I backed up and zero outed mbr and kept back up on same disk

rhklinux · 01-14-2013, 06:20 AM

I took backup of mbr by

Code:

dd if=/dev/sda of=mbr-backup bs=512 count=1

then zero outed it

Code:

dd if=/dev/zero of=/dev/sda bs = 512 count=1

Problem here is i forgot to copy the the backup in pendrive.So i want to detect my partition (ext4) on which the mbr-backup is present so that i can restore it.

I tried testDisk:
It detects partition table type as EFI GPT
when i analyse it shows the archlinux partition but does not list the files saying .. Can't open filesystem. Filesystem seems damaged.

Any help appritiated

Kustom42 · 01-15-2013, 02:52 PM

Your file system is gone dude, you did a data dump to the drive. Your best option here is to do a fixmbr from a windows recovery disc to rebuild a new MBR.

TobiSGD · 01-15-2013, 03:12 PM

Since the OP only zeroed out the MBR the file-system is untouched. The fun thing is that Testdisk should be able to recover the disk, since you have made a backup copy of the MBR. Did you make a deep scan with Testdisk?

Kustom42 · 01-15-2013, 03:49 PM

Tobi, since he output the dd to /dev/sda wouldnt that kill the partition as well or am I wrong here? Sorry to the OP if I was.

Kustom42 · 01-15-2013, 03:53 PM

I see where I went wrong here, I completely overlooked the byte size and count arguments. Without those two arguments then I would be correct as the entire /dev/sda disk would have been overwritten but only the first 512byte block wouldve been over outputted to by the dd command here.

Again, sorry to the OP not sure why I didnt see that the first time through, been a long day heh

jlinkels · 01-15-2013, 05:06 PM

Isn't it possible to just create a partition starting at the beginning of the disk with a length which is approximately the same as it was? 99 chances out of 100 you get the beginning of the partition right and you can mount the file system. Of course it would produce errors when checking the fs, but maybe you are able to get the mbr image file.

jlinkels

TobiSGD · 01-15-2013, 05:21 PM

Should be possible, if you can figure out if the partition should begin at sector 63 (partitioned by older Windows versions and older versions of Linux) or sector 2048. And of course assuming that the partition with the MBR copy on it was the first partition in the disk.

syg00 · 01-15-2013, 06:09 PM

Quote:

Originally Posted by rhklinux

I tried testDisk:
It detects partition table type as EFI GPT

This likely means all the old presumptions about partition location are invalid.

I'm mildly surprised the OP could actually zap the dummy MBR that gpt uses for compatibility. "dd" is kinda stupid that way - it does what its told to do.
If testdisk won't find your files, you might have to resort to a scraper like photorec or foremost. Ugly, very ugly.

TobiSGD · 01-15-2013, 08:51 PM

It is Arch Linux. I assume that the OP would know if he used GPT or MBR for partitioning the disk.

rknichols · 01-15-2013, 09:29 PM

If the disk was, at some time in the past, partitioned with GPT, then there would be a backup GPT at the very end of the disk. If you've zeroed out the MBR and its primary partition table, testdisk is going to see that old backup GPT and think that was how the disk was last partitioned.