Partition broken with dd command under Linux

[intruz]

Hello

I am new here so hello for all.

Yesterday my system has crashed (installed on Barracuda 500 GB). I wanted to
quickly repair my OS (Linux) so i've downloaded live ISO image. Unfortunately
i executed this command :

Code:

dd if=live.iso of=/dev/sdb

insead of :

Code:

dd if=live.iso of=/dev/sdd

The effect is... i've lost partition on /dev/sdb

/dev/sdb = 80 GB harddrive,
/dev/sdd = 4 GB flash drive

On this 80 GB HDD i stored about 50 GB's of the VirtualBox hard drive images
and about 3 to 4 GB documents. I dont care about this Vbox images only about
my documents.

ISO size was about ~ 700 MB, so the partition contents was overwritten not too
much.

The original partition type was NTFS created under Windows 7. Currently i am working on OpenSuse.

Please, help me.

Regards.

[wizard.number.next]

I am not expert of physical DR. I know that NTFS is quite hard to get data back, because of its complicated structure. You would need some very good program for it and I doubt it would be free of charge. Unfortunately I was in your situation already. In the end 400GiB of data wasn't worth price of good NTFS recovery program. If you put your documents prior to VBox images, you are lucky, if you put documents later - you could in serious trouble. NTFS uses streams on top of i-nodes and NTFS specification is kept secret. On top of all problems you already have destroyed $MFT and most probably $MTFMirr as well (I do not know where mirror is placed, but MFT is in front of partition). Even if decide to get data back by software, this would take considerable amount of time.

Maybe somebody would come with some idea about getting $MFT back in place, but it would complicated process and one error could destroy even more data.

P.S. In theory all data ever written to drive is readable, but do not count on it, as I am DR specialist - rather theory specialist.

[drc]

MFT is usually around 3GB, so is probably fine in this case. I would expect any competent recovery software should be able to get back all files that were not physically overwritten; R-studio and getdataback would be good starting points.