Hard Disk is wipedout // recovery needed

hkjz · 03-10-2020, 07:42 AM

Hey,

i have external hard drive,
while it was plugged in and something was being copied from/to, i plugged in USBstick and used MX Live USB Maker.

I selected wrong target USB Device and 'dd' process started. I canceled it after couple seconds, but problem arrived unavoidable.

Interesting is that copying process was going on, and till i unmount the hard drive later, all datas were accessible.

After mounting it again, output is like this

Code:

Disk /dev/sda: 1.8 TiB, 2000398934016 bytes, 3907029168 sectors
Disk model: M3 Portable     
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x814555ba

Device     Boot Start      End  Sectors  Size Id Type
/dev/sda1        8192    92159    83968   41M  c W95 FAT32 (LBA)
/dev/sda2       92160 15126527 15034368  7.2G 83 Linux

What is best and save approach to successful recovery.
What are the news that i wont like?

This is window of Gparted,

link
https://gparted.org/display-doc.php?name=help-manual

https://i.postimg.cc/dtGPJvX2/gpart.png

beachboy2 · 03-10-2020, 07:58 AM

hkjz,

Make a cloned copy of the drive and work on the copy, not the original.

Plenty of advice here:
https://askubuntu.com/questions/9825...did-dd-dev-sda

Also TestDisk, PhotoRec, QPhotoRec:
https://www.linuxquestions.org/quest...hotorec-37712/

syg00 · 03-10-2020, 05:37 PM

Not much to add to that really - that askubuntu link seems to cover it pretty well.

Quote:

Originally Posted by hkjz

Interesting is that copying process was going on, and till i unmount the hard drive later, all datas were accessible.

This is covered in the referenced link - very unfortunate you umount'd it. Whilst mounted all the partition and filesystem structure is known, and accessible in memory; makes recovery much simpler and likely to succeed.
Testdisk is best for recovering the partitions themselves normally, and I have successfully used "mkfs -S ..." on deliberately over-written ext filesystem as a test. Note this was on a specially constructed (small-ish) test environment. That's a capital S, and read the caveats in the manpage. Might be worth a try on that cloned copy suggested above.

hkjz · 03-12-2020, 07:10 AM

Testdisk is a great hint and great tool,
I will definitely use it for this task.

I will do tests on a small USBSstic, to learn software in a safe environment,

Main concern is that Data Partition is overwritten,
and now in DataRecovery partitions are overcovered/overwritten by the new once.

However, would you have any advice how to proceed with story of overwritten data filesystem structure?

Quote:

TestDisk attempts to recover lost partition data and any lost files within the bounds of the recovered partition.

source : https://www.redhat.com/sysadmin/reco...files-testdisk

Would it be a way that i'd delete all paritions and approach Testdisk on an empty drive?