Hi,

I did a big mistake and overwritten the raw hard disk using dd command. (I was trying to make an image of Win7 iso to other USB stick but chose wrong /dev/sdX!!!)

This is a Western Digital My Passport Essentials 1TB usb3 drive. Other codes I see are 0412B, R/N: C3B and ABAHFA.

I recognized what I've done pretty quickly and stopped it, but it has already overwritten significant amount of data, enough to destroy the partition table, etc. i might have probably overwritten around ~500mb. Disk is 1TB, there shall be many files recoverable, but the disk is now seen as a UDF Win7 installation disk

Now, in order to try to recover part of the data inside, I would like to first re-build the original partition table structure with the NTFS partition inside. Then I can try to fix the ntfs structure or recover files from it.

So I need an output of the partition layout, partition list and start/end sectors, etc. I will recreate it on mine.

I think you can see it through gparted or any other partition application. (gparted shows some information of start & end sectors when you click information on a partition context menu).

Many thanks

NTFS backup should useable...
You can try testdisk, i think it can do the job.

_________________
Lemmy

Thanks, I will give testdisk it a try. I tried already photorec and it started to extract files, but there are too many files on this disk and the real file i need is a 50 gig truecrypt volume. All others were backed up here and there.

Thanks Spildit, I'll give it a try as well. I'm downloading now (and testdisk is running since few hours...)

I'm still looking for the original partition table that would ease the job greatly, any help from forum members are appreciated.

I managed to recover a very important file after TestDisk discovered the drive after its deeper scan mode. Good! I will try to recover whatever I can now.

My approach would be to clone the drive, sector by sector. Then, assuming the size of the Win7 ISO file is 500MB, use dd or some safer utility to copy the first 500MB from your cloned drive to a test file. Compare this test file against the ISO and determine the offset at which they begin to differ. Divide this offset by 512. This will give you the sector number where the corruption ends and your original data begin. Use dd to write zeros up to this point on your clone. By doing this, you will prevent bogus data from confusing your data recovery software.

Now use your data recovery software (eg DMDE) to search the drive for "special sectors". I would begin at the end of the drive and perform a reverse search for the backup NTFS boot sector. You can then copy this backup to sector 63 or 2048, or whichever sector was the original boot sector. The next step would be to use the information in the boot sector to reconstruct the partition table.

Finally, use your data recovery software to complete the job.

_________________
A backup a day keeps DR away.