LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-25-2012, 07:12 AM   #1
knspradeep
LQ Newbie
 
Registered: Nov 2012
Posts: 21

Rep: Reputation: Disabled
Unknown filesystem partition after using the dd command


I was trying the dd command and made a mess of my hard drive.
Following is the command used by me:

dd if=/dev/sda of=/dev/sda3 bs=512 count=1

and the result, the partition /dev/sda3 is showing as unknown filesystem. Is there any way I can recover the data from the partition?

Thanks in advance,
Pradeep
 
Old 11-25-2012, 07:59 AM   #2
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738
What that command did was to attempt to write the raw contents of the entire drive onto the sda3 partition. This means is was copying the mbr, file system overhead, and data. Consistent with your observation, the filesystem info on sda3 was over-written. In principle some data might be recovered using something like testdisk. My guess is that you would have to first copy what WAS sda3 to a file or to a good partition. OR---testdisk might be able to just look at the raw space---check their documentation.
 
Old 11-25-2012, 09:19 AM   #3
knspradeep
LQ Newbie
 
Registered: Nov 2012
Posts: 21

Original Poster
Rep: Reputation: Disabled
yes I ran the testdisk and it was able to detect the original partition.
 
Old 11-25-2012, 09:38 AM   #4
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Germany
Distribution: Whatever fits the task best
Posts: 17,131
Blog Entries: 2

Rep: Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833
Quote:
Originally Posted by pixellany View Post
What that command did was to attempt to write the raw contents of the entire drive onto the sda3 partition. This means is was copying the mbr, file system overhead, and data. Consistent with your observation, the filesystem info on sda3 was over-written. In principle some data might be recovered using something like testdisk. My guess is that you would have to first copy what WAS sda3 to a file or to a good partition. OR---testdisk might be able to just look at the raw space---check their documentation.
Minor correction: It copied only the MBR of /dev/sda to the partition /dev/sda3, since the blocksize was limited to 512 bytes and the count was set to 1.
 
1 members found this post helpful.
Old 11-25-2012, 12:28 PM   #5
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738
Quote:
Originally Posted by TobiSGD View Post
Minor correction: It copied only the MBR of /dev/sda to the partition /dev/sda3, since the blocksize was limited to 512 bytes and the count was set to 1.
OOOOOOOPS!!---first mistake since thanksgiving.....

Does writing to the first 512 bytes of the partition wipe out the filesystem?
 
Old 11-25-2012, 01:19 PM   #6
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Germany
Distribution: Whatever fits the task best
Posts: 17,131
Blog Entries: 2

Rep: Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833
I would assume that it overwrites parts of the first superblock, which can be restored from the backup superblocks. That would also explain why the OP was able to mount the partition with Testdisk.
 
1 members found this post helpful.
Old 11-25-2012, 03:50 PM   #7
jefro
Moderator
 
Registered: Mar 2008
Posts: 15,691

Rep: Reputation: 2264Reputation: 2264Reputation: 2264Reputation: 2264Reputation: 2264Reputation: 2264Reputation: 2264Reputation: 2264Reputation: 2264Reputation: 2264Reputation: 2264
As noted, the 512 bytes of SDA were written to the actual partition of SD3. What you should have done was to save it to a file instead.

dd if=/dev/sda of=/dev/sda3/mbr.img bs=512 count=1

The only way to recover date from sda3 now is to either know the original first 512 or try to use recovery tools like testdisk.
 
Old 11-25-2012, 03:53 PM   #8
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Germany
Distribution: Whatever fits the task best
Posts: 17,131
Blog Entries: 2

Rep: Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833Reputation: 4833
Quote:
Originally Posted by jefro View Post
As noted, the 512 bytes of SDA were written to the actual partition of SD3. What you should have done was to save it to a file instead.

dd if=/dev/sda of=/dev/sda3/mbr.img bs=512 count=1
This won't work. You have to mount a filesystem if you want to create a file on it, you can't directly use the device descriptor of its partition.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
10.04 erase partition. Result: error: unknown filesystem grub rescue> cunvegas Linux - Newbie 8 12-08-2010 01:49 AM
mandriva dual boot filesystem type unknown,partition type 0x7 llearner Linux - Newbie 2 01-24-2010 03:03 PM
Can't access files in lvm partition: unknown filesystem type 'lvm2pv' First Onlooker Linux - Newbie 2 11-26-2009 06:24 AM
GRUB won't load windows partition - root (hd0,0), Filesystem type unknown partition.. cillm527 Linux - Software 4 04-27-2008 07:44 AM
root (hd 0,0)Filesystem type unknown, partition type 0x7chainloader +1 ece30675 Linux - Distributions 5 07-20-2004 10:04 AM


All times are GMT -5. The time now is 10:09 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration