Accidentally overwrote boot information on external hard drive.

kabbotta · 09-12-2013, 01:36 PM

I was using my brother's computer to make a USB boot drive for Arch Linux. The USB stick didn't show up on his computer and I accidentally wrote the Arch Linux boot information to his 2TB external hard drive (his computer runs windows 7 and it is a WD external hard drive). Obviously, on his computer the drive became completely unrecognized and only asks to be formatted.

When I plug it into my computer and run testdisk it can see the tiny 500mb portion that is assigned to be the boot for ArchLinux and it can see the entire 1.8TB of "unallocated" information still left of my brother's data. Gparted was unable to recover anything from the 1.8TB unallocated partition and it gives me the warning that the drive appears to have GPT signatures but doesn't have a valid fake msdos boot table. When I ran testdisk it warned me that the number of headers and sectors was wrong, but I wasn't able to change them in the geometry section to get it to run right.

I can give you any readouts you need. I'm just not sure what to put up yet. Thanks, I hope this is a good place for this question.

TobiSGD · 09-12-2013, 03:09 PM

Have you tried a deep scan for partitions with Testdisk?

kabbotta · 09-13-2013, 02:08 AM

Yes, thanks for the reply, the deep scan just finished and this was the output:

Code:

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdf - 2000 GB / 1862 GiB - CHS 243198 255 63

The harddisk (2000 GB / 1862 GiB) seems too small! (< 4453 GB / 4147 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
>  FAT32                297368 104 41 541416 167 18 3920635067
   FAT16 <32M           314815 218 22 508686 209  1 3114537028

TobiSGD · 09-13-2013, 06:52 AM

In that case it is unlikely that you will be able to restore the partition table. But even if you would be able to restore that you would still have the problem of a broken filesystem, since you overwrote the first 500MB of it. In this case the only thing I can think about to restore the data that is not overwritten is to use Photorec to search for files in the part that is now unallocated.