Hi All

I am a newbie and ran the dd backup command in windows 10 to backup a hard drive.After 5 min I pressed ctrl c
because I thought nothing was running.The whole file structure is wiped and when trying to recover I got fuse_hidden files but with completely different file names.Running photorec the files have been retreived but with 885 recup_directories and f112434.txt,f112434 etc.It is doing this now for every ectension .pdf.jpg.mp4 and there is almost 400g worth of data and trying to work through this is going to take months just to rename it to the right document.Is there a way I can maybe reverse the dd command to restore everything and the right file structures and naming conventions with regards to the file?
Any help will be highly appreciated.

Thanks
Hunty

I'm afraid you did overwrite the content of the disk, there is no way to revert it back unless you have a copy or backup.

Hi pan.Sda1,sda2 and sda3 was on this drive.After running the dd if=/dev/sda of=/dev/sdb command I pressed control C as I was under the impression that nothing was running.sda1,sda2 are ok but sda3 are there but all the files are gone.
Tx
Hunty

that will not help to go further. what will fdisk -l respond?

/dev/sda1 * 2048 206847 204800 100M 7 HPFS/NTFS/exFAT
/dev/sda2 206848 209717247 209510400 99.9G 7 HPFS/NTFS/exFAT
/dev/sda3 209717248 976756719 767039472 365.8G 7 HPFS/NTFS/exFAT

dd if=/dev/sda of=/dev/sdb will copy the whole disk (not partitions) from the first one to the second one (if exists). I do not know what have you really tried because this command will not modify anything on sda1, sda2 and sda3 (not able to do that)

Is there any way I can sort of rebuild the partitions table and try to recover the files with its naming conventions in tact as all i get now is the fuse_hidden files and when running photorec i get alot of files back but with different naming conventions f1 f2 f3 etc.
Thanks for the help thus far
Hunty

Nope, if you borked the filesystem's file table, then those filenames are probably gone.

[b]testdisk[/] MAY be able to restore the partition table from a backup.

Then, you MAY be able to use the filesystem's scanning and recovery tools (chkdsk for Win fsck for Linux) to restore a backup table .

I stress MAY, as in you MAY get LUCKY. Good luck, you'll need a lot of it.

Otherwise you're going to have to be content with photorec's recovery efforts. Now you've learned to be more careful with dd for sure. Don't worry we've all been there at some point or another. It's a painfil learning experience.

The other day, I was messing with Conky and wanted to see how it responded to a higher CPU load. So I wanted to run "dd if=/dev/zero of=/dev/null", but I somehow ended up typing "of=/dev/sda". Thank God that normal users can't write to block devices...

I still fail to see where your problem is. Did you mix up sda and sdb when running the dd command?

I think you're looking at the wrong disk. dd never writes to the source, it writes only to the destination. When you say that sda1 and sda2 are ok and the files on sda3 are gone, it sounds to me that this was the destination of your dd command. When you interrupted it, sda1 and sda2 were finished and sda3 was in progress. So look at the other disk, all your files should be there. If so, then re-run the dd command and let it finish. If you want to see the progress of dd, have a look here


Note: When you run dd you ALWAYS have to double check that you write to the right disk. the names can change depending on what SATA port they are connected to.

Do not use dd.
End of discussion.

It's a good tool for what it is designed to do, but the user community just ain't up to the game. Making backups ain't what it should be used for - much better options exist.

Hi
Thanks for the information.
Appreciated.
Hunty