Recovering HD

[Kai Baker]

I messed up pretty bad. But I suppose I'm bound to come across this situation eventually.

I accidentally used dd to copy an iso to my second hard drive instead of my flash drive. It was only 1.2 gigs, so my main storage, which was stored on a higher section of my drive, wasn't over written. However, the journaling of my system was ruined. Is there any way to recover the data stored on my external hard drive? I don't know exactly where it starts, but it's roughly the 1TB mark on a 2 TB hard drive. Would it be feasible to use dd to copy the second terabyte from that hard drive on to a third?

[Brian]

Is the system still on? I had done this with a 17 MB firmware update written to my boot drive instead of a USB. 

So the journal and fs structure was still in memory I was able to copy everything to another system before reinstalling the OS.

Good luck.

On Apr 5, 2017 8:54 PM, "Kai Baker" <eigen...@gmail.com> wrote:

I messed up pretty bad. But I suppose I'm bound to come across this situation eventually.

I accidentally used dd to copy an iso to my second hard drive instead of my flash drive. It was only 1.2 gigs, so my main storage, which was stored on a higher section of my drive, wasn't over written. However, the journaling of my system was ruined. Is there any way to recover the data stored on my external hard drive? I don't know exactly where it starts, but it's roughly the 1TB mark on a 2 TB hard drive. Would it be feasible to use dd to copy the second terabyte from that hard drive on to a third?

--
You received this message because you are subscribed to the Google Groups "Collexion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to collexion+unsubscribe@googlegroups.com.
To post to this group, send email to coll...@googlegroups.com.
Visit this group at https://groups.google.com/group/collexion.
For more options, visit https://groups.google.com/d/optout.

[Kai Baker]

Luckily it's not my main hard drive, only a second hard disk. /dev/sda is my main one which was left untouched. It's the /dev/sdb drive which was damaged. I rebooted my system and it tried to fix sdb but wasn't able to for obvious reasons. /dev/sdb still shows up on fdisk -l, so I figure it's not completely fubared. I have a third hard drive I can install and use dd to transfer the data from /dev/sdb to the new one. However, I don't know where it starts. Would it be possible to use dd to transfer a chunk from my sdb drive to the third one and recover the data that way?

--

http://opency.biz

[Brian]

If DD has a byte offset you could calculate a guesstimate. Idk much after that for FS forensics, just wanted to quickly reply in case the drive was still mounted.

 May be worth booting up a Kali Linux install for some of its tools, idk any specifically.

[Kai Baker]

Maybe I can create an iso from the guesstimated size of /dev/sdb using mkisofs and store it on a second hard drive?

[Kai Baker]

What I think I'll do is I'll get a 2.5 or 3 TB HD and simply copy the entire 2TB HD to this larger one. Even if the bottom 1.2 GB has been overwritten with something else entirely, would it be possible to access the desired data after the transfer?

--

http://opency.biz

[Kai Baker]

Good news! I was able to recover my data since it was a separate partition than the one I wrote to. I used the software TestDisc to get it back. So in case someone makes the same stupid mistake I made, try these instructions on this webpage.

http://www.dedoimedo.com/computers/linux-data-recovery.html

--

http://opency.biz