If you are going to use dd to create the image.dd file, this must be on a seperate disk or partition and the partition must be big enough to take the entire previous partition.

If you try to create the file on the same partition, you will overwrite the data that you are trying to recover with the image file.

Ok, I'll try to explain it as best I can. Say we have 2 HDDs, one external one that has been nuked like you have call it /dev/nuked, one internal one that you are using right now and is just fine call it /dev/good.

You are working within /dev/good, when you boot the partitions on this drive are mounted automatically and your system is up and running. Let's assume you have enough space on a partition in /dev/good to hold an image equivalent to the partition you lost on /dev/nuked (250 GB), do you ? If not, then you can't do it. But if you do have enough space you would make the image by running:

This reads the nuked partition into a file called image.dd in your home folder. You can then run programs on this image to get files off.

If you do not have 250 GB free on /dev/good then simply run the programs on the /dev/nuked itself. For example with foremost you can pipe the output of dd straight to it:

One more thing to mention, I recommend you do NOT mount /dev/nuked at all as it may change data on there. If you do have to mount it then only mount it read-only.

I would always recommend using Helix3. It is a forensic toolkit that won't make any changes to your disk (thus making a bad situation worse) when finding files.

It is freeware, is easy to use and can do some really cool stuff including finding files that have long since been deleted.

I have stepped back from the brink of disaster on several occasions!

http://www.e-fense.com/helix/