Whilst burning .img files to sd card, I stupidly plugged in my external drive to backup, which became /dev/sdb instead of the sdcard. This meant I wrote the Nook UsbHostpatch to my external drive by accident (only 50mbish). Whilst this couldn't have had long enough to properly overwrite all my files ( a 300gb disk), part way through, my computer crashed.

When I restarted I realised what I'd done. First time round running testdisk (using the intel/pc option) it quickly gave a huge amount of read errors, and found no partitions (not even the one that I can see in nautilus – a partition named boot, with the files that I wrote onto it, and which the Disk utility lists as being FAT (32 bit version).

After unmounting, removing, and remounting, I ran testdisk again.It didn't give read errors this time. Short version found nothing, so I ran deeper search. This soon said:

“Warning: number of heads/cylinder mismatches 64 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)
FAT32 0 0 1 229 119 18 3686400 [boot]
”

It didn't manage to find my previous file system/ partition.

Back in the main menu, it's giving data about the disk as:

Disk /dev/sdb - 320 GB / 298 GiB - WD 3200BMV External
CHS 38913 255 63 - sector size=512

I think the external drive was previously ntfs, since I had used it with windows, as well as linux.

Is there anything else I can try? Is it worth changing the numbers for cylinders/ sectors?Cheers.

ok so I ran gpart on it, and got a huge number of
"* Warning: read error (EIO) near sector(624884511), skipping..." (many many more like this, too many to post here)

I'm guessing that's a bad sign and the drive maybe a gonner, but I'd still like to recover whatever data I can. Is there still any way I can get the partition table back?

OK, so i had a look at what PhotoRec was saying, and it came up with this:

Disk /dev/sdc - 320 GB / 298 GiB (RO) - WD 3200BMV External

Partition Start End Size in sectors
> Unknown 0 0 1 38913 80 63 625142448 [Whole disk]
P FAT32 0 0 1 38913 80 63 625142448 [boot]


I'm guessing that here the 'unknown' partition maybe the one I accidentally overwrote. I don't have another disk as big as this one I can copy this to, but I've just ordered one so I will try that in a few days time, but if its still possible to rescue the partition table and this disk that would be ideal - does that look like it would still be possible?

Cheers.

You overwrote the Master Boot Record and Partition Table space on your WD (and more but OK). When you run testdisk give it the "/debug /log" switches so you have a log to read (or post) later on. As long as you don't write anything to the disk you can safely set CHS values when configuring testdisk. You can make testdisk write a clean Master Boot Record and Partition Table to the disk. That contradicts the previous line and while overwriting usually shouldn't be done on victimized media but well, it's gone anyway.

This is the log from I think the first time I ran testdisk yesterday:



Sat Feb 8 13:56:25 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.12-1-amd64 (#1 SMP Debian 3.12.6-2 (2013-12-29)) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-17T13:40:45
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WD 3200BMV External, FW:1.75

Partition table type (auto): None
Disk /dev/sdb - 320 GB / 298 GiB - WD 3200BMV External
Partition table type: Intel

Interface Advanced

Interface Advanced

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
FAT32 at 0/0/7
FAT1 : 32-3624
FAT2 : 3625-7217
start_rootdir : 7218 root cluster : 2
Data : 7218-3686393
sectors : 3686400
cluster_size : 8
no_of_cluster : 459897 (2 - 459898)
fat_length 3593 calculated 3593
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/0/7
FAT32 0 0 1 229 119 18 3686400 [boot]
FAT32, blocksize=4096, 1887 MB / 1800 MiB
Partition not added.

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
---
Should I set heads to 255 and sectors to 63? And If I set it to create a new MBR as ntfs might that help it find the old partitions/files?

and when you say, 'well, its gone anyway' do you think there's no chance of me getting this stuff back?

Cheers for the help.

If those are the devices original settings, yes.


What adding a generic MBR and PT does is keep testdisk from looking at it so a deep search may yield more relevant results.


Uh, sorry, I meant only the MBR, PT and amount of data overwritten. If you can re-establish the partitions boundaries you may be able to use a spare super block.

Ok thanks, sorry for the slow reply. I'm trying to find enough time to do this properly so that I don't mess things up further/ so that I have a whole day when I can leave my laptop running...

How do I go about creating a new MBR? Is it the same idea as this? http://www.cgsecurity.org/wiki/Menu_MBRCode
I wasn't sure, because this has never been a disk I boot from...

--


I also find something on the TestDisk wiki which said this:

Recovery of reformatted partition
If the partition has been reformatted to another file system (FAT32 formatted as NTFS or vice-versa),
run TestDisk,
select the hard disk and the partition type
choose Advanced
select the partition
choose Type,
enter the value corresponding to the previous filesystem
choose Boot
choose RebuildBS
List
If you can see your files, choose Write and confirm
In Analyse, choose to rewrite the partition with the correct partition type.
Return to TestDisk main page

--

is that something similiar/ worth trying first?

Cheers.

Yes.


Sure. This only affects the MBR and Partition Table, not what data remains. Just to be sure do set the correct CHS values before writing please and don't forget to add the "/debug /log" switches so we can read along should that be necessary.

Ok thanks a lot.

Ok so I know this now pretty long ago...well I at last got round to having another go at recovering this data. I ran testdisk on the .iso again, choosing intel/pc partition, and after having written that new mbr to and having 'deleted all data in the partition table'.

Running the full disk scan I got no results, nothing found:

Disk /media/usb0/copy-external1.iso - 320 GB / 298 GiB - CHS 38914 255 63
No partition 0 0 1 38913 254 63 625153410

(actually i failed to get it produce logs unfortunatelly...)

I guess this means there's nothing else I can do to get that stuff back? I'm pretty sure that devices/heads/sectors are set as they would have been originally for the device: i.e. it's a device i bought off the shelf, so would have been ntfs, which explains the 254 / 63?

Alas, I will mourn my data, unless anyone has any other miraculous ideas!
Cheers.