I stupidly ran the following command on an external ext4 USB disk, typing /dev/sdb instead of /dev/sda which was the new disk I was setting up:

dd if=/dev/zero of=/dev/sda bs=512 count=100

These were the lines I used to initially set up that drive, I was just going to repeat them:

dd if=/dev/zero of=/dev/sdb bs=512 count=100  
parted -a optimal /dev/sdb mklabel gpt  
parted -a optimal /dev/sdb mkpart -- primary ext4 1 -1  
mkfs.ext4 -L BIGDRIVE /dev/sdb1

Can I retrieve the boot sector and get the drive operational again?

  • Most data is still there (well, all but 50kb). All is not lost. I'm not an expert here, so I'll just wait for somebody else to write out how exactly to proceed... but essentially, you probably have to rebuild the partition table and (I'm not sure how much is destroyed) recover the root inode of the first partition - it depends on how or if even this drive was partitioned and what the offsets are. – orion Feb 24 '15 at 9:16
  • Thanks for the quick reply. I've got testdisk running on Yosemite and it has found the partition data- it says the structure is OK. Will a simple 'write' bring the partition back? – Jon Hart Feb 24 '15 at 9:31
  • 1
    It really all depends on what was there before: gpt, mbr? Given that the partitions are nowadays aligned to 1MB, only the partition table was destroyed (not sure how much). I would do this: dd the first megabyte into some backup file just to be sure. The first 50kb are zeroes anyway, but if anything goes wrong, you'll have the dump to put back. Then rewrite the partition table and try to mount all partitions (read-only!). If it works, that's it. – orion Feb 24 '15 at 9:52
  • Disk was gpt. After testdisk did its recovery it seems OK. Anyone who is an expert with testdisk could tell me if I've fully repaired the damage (if any). All I did was get it to recognise the partition table and then used the 'write' option. I have no idea if this was the right thing, but the disk now mounts under OpenElec (the distro I'm using). – Jon Hart Feb 24 '15 at 10:58
  • If all partitions can be mounted, this is it. The only real job of the partition table is to find the correct ranges where partitions are located. Everything else is just sugar and can be changed later if you notice any difference (partition types, bootable flags and so on). You can run fsck on all partitions if there is any extra damage, but it should be fine. You didn't damage the data part of the disk. – orion Feb 24 '15 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.