I was trying to read data off a friend's bad flash drive using dd_rescue (basically the same as dd). I couldn't get it to save the data to a file though, so I did the following (I'm quite embarassed):


dd_rescue /dev/sda /dev/hda

I thought it would just add an image of the flash drive to hda! Now, my comp will POST but grub will not load (I had a dual boot Debian/Windows, it just says "Strike F1 to retry boot).

What can I do to recover what I had? I'm hoping at least one of the partitions remains. I'll ask about using dd properly in another post. I presume it has something to do with a bootdisk, but I don't know what to put on the bootdisk to check what remains on the HD and get the MBR set up.

How many partitions did you have on this machine?

The MBR and partition table is toast, as is the beginning of the first partition. Your other partitions should be alright, but it depends on how much dd wrote to the beginning of the drive and how large the first partition was in the first place. For instance, if you had a 64 MB /boot partition followed by your root partition, and you wrote 128 MB to the drive then you would have totally wiped out partition 1 and the beginning of partition 2.

Unless you have a backup of the partition table (MBR is easy enough to replicate) you are going to have a bit of a problem.

Boot with Knoppix, run testdisk, save what can be saved. Once partition table is restored you'll find everything is intact exept the hda1. OS in first partition has to be reinstalled, unless it was some Linux distro which can be rebuilt (like Gentoo).

Thanks for the replies. I'll try Knoppix with testdisk and reply back if I have trouble.

I got Knoppix with testdisk, but still trouble. Here is what it says when I try to mount hda:


Here is what shows up after I run fdisk -l after creating a new MBR with testdisk:


The ideal situation would be that Windows remains OK and I could rebuild Debian. Even if Windows is ruined I'd really like to restore Debian - had some mysql databases on it and a configuration I liked.

Do you recognize your disk layout? Testdisk can find old obsolete partitions, too. You do not mount hda which is entire HDD, you mount hda1, hda2, so on.

You could boot with something like Helix and see what you can save. I know it's like knoppix, but it may work better.

Thanks for the replies. I'm doing a little bit every day on this - I have a replacement computer at work so I can use that for now. Tomorrow or Thursday I am going to try to mount the hda1/hda2/hda3/hda4 partitions. I'm hoping at least hda2 and hda4 mount based on the post I made above - I don't know when it has file system unknown for hda1/hda3. I'll also try Helix if this doesn't work out. I'd really like to be able to rebuild the Debian partition, which I think should be hda1. I'll ask more after I try what's been suggested. Thanks again.

I'm not convinced you restored correct partitions with testdisk. You should see your partitions with Windows and Linux filesystems. Only hda1 should show up "Unknown". In any case, if contents of this drive is important to you I suggest you take an image of it with dd before you change anything.

I believe hda1 should be Windows, hda2 is Debian, hda3 is swap, and hda4 is the flash drive data that I copied.

I edited /etc/fstab to look like the following:

However, when I type mount /dev/hda2 /media/hda2, I get the message:

Not sure where to go from here, maybe just a newb thing with not mounting properly?

If you sent flashdrive data to hda then it cannot be on hda4. fdisk -l output does not look good. As I said before, try that teskdisk again, hda2, hda3 and hda4 should be intact.