LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Unknown filesystem partition after using the dd command (https://www.linuxquestions.org/questions/linux-newbie-8/unknown-filesystem-partition-after-using-the-dd-command-4175438619/)

knspradeep 11-25-2012 06:12 AM

Unknown filesystem partition after using the dd command
 
I was trying the dd command and made a mess of my hard drive.
Following is the command used by me:

dd if=/dev/sda of=/dev/sda3 bs=512 count=1

and the result, the partition /dev/sda3 is showing as unknown filesystem. Is there any way I can recover the data from the partition?

Thanks in advance,
Pradeep

pixellany 11-25-2012 06:59 AM

What that command did was to attempt to write the raw contents of the entire drive onto the sda3 partition. This means is was copying the mbr, file system overhead, and data. Consistent with your observation, the filesystem info on sda3 was over-written. In principle some data might be recovered using something like testdisk. My guess is that you would have to first copy what WAS sda3 to a file or to a good partition. OR---testdisk might be able to just look at the raw space---check their documentation.

knspradeep 11-25-2012 08:19 AM

yes I ran the testdisk and it was able to detect the original partition.

TobiSGD 11-25-2012 08:38 AM

Quote:

Originally Posted by pixellany (Post 4836510)
What that command did was to attempt to write the raw contents of the entire drive onto the sda3 partition. This means is was copying the mbr, file system overhead, and data. Consistent with your observation, the filesystem info on sda3 was over-written. In principle some data might be recovered using something like testdisk. My guess is that you would have to first copy what WAS sda3 to a file or to a good partition. OR---testdisk might be able to just look at the raw space---check their documentation.

Minor correction: It copied only the MBR of /dev/sda to the partition /dev/sda3, since the blocksize was limited to 512 bytes and the count was set to 1.

pixellany 11-25-2012 11:28 AM

Quote:

Originally Posted by TobiSGD (Post 4836553)
Minor correction: It copied only the MBR of /dev/sda to the partition /dev/sda3, since the blocksize was limited to 512 bytes and the count was set to 1.

OOOOOOOPS!!---first mistake since thanksgiving.....;)

Does writing to the first 512 bytes of the partition wipe out the filesystem?

TobiSGD 11-25-2012 12:19 PM

I would assume that it overwrites parts of the first superblock, which can be restored from the backup superblocks. That would also explain why the OP was able to mount the partition with Testdisk.

jefro 11-25-2012 02:50 PM

As noted, the 512 bytes of SDA were written to the actual partition of SD3. What you should have done was to save it to a file instead.

dd if=/dev/sda of=/dev/sda3/mbr.img bs=512 count=1

The only way to recover date from sda3 now is to either know the original first 512 or try to use recovery tools like testdisk.

TobiSGD 11-25-2012 02:53 PM

Quote:

Originally Posted by jefro (Post 4836786)
As noted, the 512 bytes of SDA were written to the actual partition of SD3. What you should have done was to save it to a file instead.

dd if=/dev/sda of=/dev/sda3/mbr.img bs=512 count=1

This won't work. You have to mount a filesystem if you want to create a file on it, you can't directly use the device descriptor of its partition.


All times are GMT -5. The time now is 01:36 AM.