LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   Best recovery software for my situation? (https://www.linuxquestions.org/questions/linux-software-2/best-recovery-software-for-my-situation-4175653917/)

Sol33t303 05-14-2019 10:54 PM

Best recovery software for my situation?
 
So, I ended up accidentally DDing my drive since it's device file changed from /dev/sda to /dev/sdc since I booted my PC with my USB plugged in (yeah I know, I should have checked, I'll be more careful in the future). I was trying to turn my USB into a system rescue CD USB. Here is what I ended up running "dd if=/path/to/iso of=/dev/sdc status=progress" (/dev/sdc being my SSD)

I had two drives in my PC, 1 500 GB and 1 2 TB HDD. The SSD (the drive I burned the iso to) had two partitions (also, both drives were GPT)1 EFI system Partition, and one big LVM Physical volume. The HDD was just one LVM Physical volume. Both physical volumes were in 1 volume group, and 1 logical volume took up the entire volume group. The EFI partition seems unaffected, since I could get to rEFInd (a boot manager), and it could successfully boot my PC. And my logical volume was formatted as EXT4.

I know that when you have to recover things, it's best to touch it as little as possible. I didn't realised the mistake I had made, so I booted my PC, and realised what I had done. I tried activating my LVM volume, and it failed to activate (can't remember what exactly it said, not booting back into it to find out), I then powered off the computer and that is how it has stayed.

So, what I was wandering is what recovery software should I use? This is (luckily) the first time I have had to recover anything. There seems to be multiple software available for recovery (testdisk, ddrescue, photorec), so how should I choose which to use? Seeing as I screwed up using DD, DDrescue seems like the obvious one I should use, or are one of the others a better option?

jsbjsb001 05-15-2019 12:13 AM

A couple of things:

1) You should always make sure that when using dd you KNOW that the drive you're targeting with it, IS the correct drive. NEVER assume it is the correct drive, you can check this with the lsblk command, which will give you a "tree like" view of the drives connected to your system.

2) As it says in my posting signature, if the data on said drive is important to you, particularly if you're thinking of using the dd command on it, you should ALWAYS have a backup in case you target the wrong drive.

3) The dd command works at a very low-level, so for example, if you dd'd the whole drive, then this would also wipe out the partitions on that drive as well as the data (files) on it. So there's every chance that data is lost forever.

I guess you could make a backup of the dd'd drive, then try one of the recovery tools you listed, and see if you can recover anything from it. I don't think there's any magic answer to your question though. Maybe ddrescue *might* recover something, but I suspect at least some of the data is most likely lost forever. Do you have a backup of that data before you dd'd the drive?

syg00 05-15-2019 12:33 AM

If you can boot, you didn't trash the "system" disk (presumably the SSD), but probably the 2T disk.
All conjecture. Boot up any liveCD and follow the instructions in the post here. Then we'll have some idea of what's what.

At a minimum I would expect you have lost partition table, and whatever the size of the iso was at the start of the disk - but I've never tried this on a gpt, so guessing based on MBR experience. I prefer photorec for simple restore of any files it finds. You have some control - but none of the filenames will survive; that can be a serious PITA.
And on 2T to a USB rescue disk it will take a while - maybe days - before you can even start looking at the data found.
ddrescue will not be of benefit unless you want to "dd" the entire disk to work on a copy - not necessary IMHO, but note my sigline too ... :shrug:

Sol33t303 05-15-2019 01:18 AM

Quote:

Originally Posted by jsbjsb001 (Post 5995141)
A couple of things:

1) You should always make sure that when using dd you KNOW that the drive you're targeting with it, IS the correct drive. NEVER assume it is the correct drive, you can check this with the lsblk command, which will give you a "tree like" view of the drives connected to your system.

2) As it says in my posting signature, if the data on said drive is important to you, particularly if you're thinking of using the dd command on it, you should ALWAYS have a backup in case you target the wrong drive.

3) The dd command works at a very low-level, so for example, if you dd'd the whole drive, then this would also wipe out the partitions on that drive as well as the data (files) on it. So there's every chance that data is lost forever.

I guess you could make a backup of the dd'd drive, then try one of the recovery tools you listed, and see if you can recover anything from it. I don't think there's any magic answer to your question though. Maybe ddrescue *might* recover something, but I suspect at least some of the data is most likely lost forever. Do you have a backup of that data before you dd'd the drive?

Quote:

Originally Posted by syg00 (Post 5995146)
If you can boot, you didn't trash the "system" disk (presumably the SSD), but probably the 2T disk.
All conjecture. Boot up any liveCD and follow the instructions in the post here. Then we'll have some idea of what's what.

At a minimum I would expect you have lost partition table, and whatever the size of the iso was at the start of the disk - but I've never tried this on a gpt, so guessing based on MBR experience. I prefer photorec for simple restore of any files it finds. You have some control - but none of the filenames will survive; that can be a serious PITA.
And on 2T to a USB rescue disk it will take a while - maybe days - before you can even start looking at the data found.
ddrescue will not be of benefit unless you want to "dd" the entire disk to work on a copy - not necessary IMHO, but note my sigline too ... :shrug:

First off, I made a mistake in my post. I did this all probably 24 hours ago at night. It booted into GRUB, then that booted into my system. Not rEFInd (I didn't have grub installed on my system, so it's from the iso)
As for having a backup, unfortunatly I don't, the reason being that I don't have anything else that could hold 2.5 TBs worth of data, so there is nowhere I can backup to.
This also means I don't have any space anywhere to dd the disk to make a copy of it and work on it that way. So am I just RIP?

pan64 05-15-2019 01:22 AM

the only way to restore anything is to make a copy of the dead data into a good/working partition/filesystem. This is the absolute minimal requirement. If you have no space you cannot recover. If your data is really important just buy a hdd to help to solve it.

syg00 05-15-2019 03:20 AM

Do as I suggested - you might be luckier than you realise.

rknichols 05-15-2019 09:24 AM

Quote:

Originally Posted by syg00 (Post 5995146)
At a minimum I would expect you have lost partition table, and whatever the size of the iso was at the start of the disk - but I've never tried this on a gpt, so guessing based on MBR experience.

There is a backup copy of the GPT at the very end of the disk. A GPT partitioning tool will offer to recover that, so you can definitely restore the partitioning.

If this was not the system drive containing /etc/lvm/{archive,backup}, then you can also recover the LVM structure. Then you can determine which LVM LV and its filesystem have been damaged.


All times are GMT -5. The time now is 04:26 AM.