Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I was messing around with my new hard drive, which only contains some personal files, and to check its write speed, I typed: sudo dd if=/dev/zero of=/dev/sda, /dev/sda/ being the new 2 TB connected to my Raspberry Pi.

Hopefully, I cancelled the command and only 11 MB have been written. Now disk content can't show up, and now parted tell me that the partition tree is like this:

|--- unallocated 8.00 MB
|--- unknown 1.82 TB
|--- unallocated 9.08 MB

Before, it was like this:

|--- ext4 1.82 TB

I don't know if dd did overwrite the first 11 MB of the disk, which means that the partition table have been totally overwritten, or random bits of the hard drive have been overwritten.

Now the hard drive is connected to my Xubuntu 14.04 laptop as /dev/sdb. I've tried gpart which is still running, and also testdisk without success.

Knowing that the whole disk was ext4 and that sector size was 4096, is it possible to recover the partition table without re-formating and make me able to access my files again (even if some have been corrupted/deleted)? Or the only solution I have is to use a file recovery tool, which would be tiresome because of the amount of data to copy stored on this drive?

share|improve this question
6  
Don't use the disk at all, as the more you use it the more data is irrecoverable.Preferably mount the disk as read only and make an image of the whole disk and work on that image instead. –  user251046 Aug 2 at 15:06
    
Looks like it is time to go for the backups! –  mdpc Aug 2 at 18:18

1 Answer 1

up vote 6 down vote accepted

You will first need to reconstruct the partition table the way it was. This will not affect the contents of any partition, just the system's idea of where each partition begins and ends. It sounds like you might have already done this because you seem to have a partition that exists that is "unknown", but exactly the same size as the partition was before.

If you haven't yet done that, then you can try creating one big partition using the same partition editing program that was used to create it in the first place (e.g. fdisk, gdisk, parted) and accept the default suggested placement, hoping that those defaults will result in the same placement as before. Again, here, it sounds like you know what partition software was used: parted.

After that, the trick you will need is to fsck the filesystem using a backup superblock. Once again here, you have to hope that the filesystem was created in the first place with default options, or else you have to know what non-default options were used to create the filesystem. (I would say filesystems are most typically created with default options.)

  1. Run mkfs with the same options that were used to create the filesystem in the first place (i.e. probably no options, meaning defaults), except add -n, which means don't create the filesystem for real.
  2. The mkfs output will output a list of alternate superblocks. You will need to use one of these because the main superblock of the filesystem has been overwritten. The larger the portion of the block device that has been overwritten, the more alternate superblocks from the list will be damaged.
  3. Run fsck with the -b option to specify an alternate superblock.

I have to warn you that whatever you recover is likely to be a big mess and will require lots of manual cleanup. Expect quite a bit of loss and lost files reattached in lost+found.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.