Hello,

I have made a really ridiculous error, and was hoping that people could give me some quick advice. Basically I dd'd over an entire hard drive in error :-s

The hard drive is 2tb and the image that I dd'd over it is only about 32gb (and ext4), and I have not taken any further action, so hopefully 99% of the stuff should be recoverable. I was hoping to not have to use file carving though as this would lose all of the file names.
1.8ish TB of the drive is showing as unallocated in gparted, and from what I know, I think the solution should be for me to use testdisk to recover the lost ntfs partition (that should be the whole hard drive's ntfs partition) that should then contain all of the files minus any written over by the 32gb? Does that sound right?

Also, I was unsure as to whether I should delete the 32gb ext4 partition leaving the whole drive unallocated in order to let test disk just recover from the whole drive?

I wasn't sure if this will work however as part of the deleted partition will have been written over, and I ran it till it got to 50% and there was no sign of my missing partition (I had to turn it off to do something else, but am going to leave it to do the full drive.) I was hoping this might be because it needs to have recovered all of the partition before it lists it?

I realise this is a super stupid mistake that is the one thing you need to be real careful of when using dd, but I was hoping someone could point me in the right direction?

Cheers in advance!

Chris

The first 32GB is absolutely toast. After that, you should be able to RAW recover files that haven't been overwritten....you might even get lucky and find some MFT fragments allowing for some original file and folder names.

Good luck.

_________________
Luke
Recovery Force Data Recovery

Cool,

Thanks for your quick reply. I was hoping that that would be the case (that most of it should be recoverable!)

This may be an aside that would be best suited elsewhere, but while I'm here does anyone know if scalpel can look for .dd files as I had a few disk image files on my hard drive that I need, but I don't know if it will be able to find them? Or does RAW just recover everything that is on there? What program would you use to do that if not scalpel?
It is quite hard to google a config file for scalpel that can find .dd files as mostly people are looking to use scalpel on a .dd file!!

Thanks again

Cool,

Thanks for your speedy response. I was hoping that I would probably be able to recover most of it!

What program would you use for RAW file recovery? I have used scalpel before, but that needs a config, and I need to recover .dd files, but does RAW file recovery just recover everything that is there?

I have been having some trouble finding a scalpel config for .dd files, as mostly scalpel is run on .dd files and information on this is coming up on google instead.

Thanks again, really hopeful news!

Free option: photorec which comes with testdisk (RAW only)
Pay option: R-Studio (RAW and can analyze NTFS structures)

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

Or if you're using a Mac (which I'm guessing from the .dd extensions) you can try Data Rescue 4 which can learn new file types by just dragging them on top of it.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

I'm actually using linux, but I used dd to create images of a couple of USB sticks I could really do with getting back.
By raw, do you mean raw photo files, or is a raw file something else?

Cheers!

Raw file is not like a Raw photo...
http://www.easeus.com/datarecoverywizar ... -drive.htm

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

Ah cool,

I thought that may have been what they meant.

Thanks all!

Were these USB sticks formatted as FAT32? If so, and if the dd images were laid down as contiguous files, then all you would need to do would be to search for FAT32 boot sectors with a disc editor and then dd the blocks of data immediately following them. Otherwise, if the image is fragmented, then you would need to locate its MFT record and rely on your data recovery software to reassemble it.

_________________
A backup a day keeps DR away.

MFT is in range of what is overwritten. It usually starts 3 GB into the volume and is maybe 100..200 MB in size, so I'd expect nothing of it remains.