I have a 1.5 TB partition of data, of which I accidentally overwrote some bytes at the beginning, due to a typo like:
ssh somewhere command | dd of=/dev/sda3 // should have used quotes here, dd was executed locally by mistake!
/dev/sda3 holds a LUKS container for the 1.5 TB ext4 partition with important data.
When I noticed the problem I suspended and killed the dd; it should have overwritten less than 4K.
Is there a way to recover the data? The computer has not been rebooted since, so whatever data was lost may still be in RAM? What do the first (say) 4k of a LUKS container contain?
The partition is still mounted, but shows errors like
[1157706.786897] EXT4-fs error (device dm-4): htree_dirblock_to_tree:896: inode #2: block 9249: comm ls: bad entry in directory: rec_len % 4 != 0 - offset=0(0), inode=2791782547, rec_len=44529, name_len=90
when trying to access it.
PS: I made some more tests and it seems more data was overwritten than just 4K :-( But still a very very small percentage of the 1.5 TB data! Can I still dump data from the uncontaminated region - maybe search with an ext4 recovery tool (if a good one exists) in a dump of the /dev/mapper/cr_sda3 - would that still work?