I'm stuck in a tricky problem. Context : Yesterday I made a cloning script for my raspberry pi that dd a whole running pi filesystem into a local sdcard on a computer connected through ethernet. It was late, I was starving and tired : I dd the pi into... /dev/sda, my computer main fs, instead of /dev/sdb (the sd card). Because everything was running in memory I didn't noticed the error before I reboot this morning... :cry:

So, instead of my 600go+ filesystem (which was partioned with LVM, without encryption, running debian jessie, but I cant remember the initial partition sheme) I now get a 4go raspberry pi filesystem which is not even booting since its arm. ::cry::cry:cry: (i am on amd64 btw)

My current partition sheme looks like :

SCSI1 (0,0,0) (sda) 640.1GB ATA Hitachi HTS54756
n° 1 primary 64.0MB fat16
n° 2 primary 4.0GB ext4
pri/log 636.1GB free space

or, in lsblk fashion :

NAME                          MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda                             8:0    0 4G  0 disk 
├─sda1                          8:1    0   64M  0 part /boot
├─sda2                          8:2    0     4G  0 part /

As far as i remember, before it was something like :

NAME                          MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda                             8:0    0 640.1G  0 disk 
├─sda1                          8:1    0   2?M  0 part /boot
├─sda2                          8:2    0     ?K  0 part 
└─sda5                          8:5    0 ?G  0 part 
  ├─mycomputer--vg-root   254:0    0   ?G  0 lvm  /
  ├─mycomputer--vg-swap_1 254:1    0   ?G  0 lvm  [SWAP]
  ├─mycomputer--vg-var    254:2    0   ?G  0 lvm  /var
  ├─mycomputer--vg-tmp    254:3    0   ?M  0 lvm  /tmp
  └─mycomputer--vg-home   254:4    0 ?G  0 lvm  /home

Everything I need to get back was on /dev/sda5

AFAIK, what the dd command did yesterday was :

  1. writing all the bits on the first 4go
  2. converting the "rest" (636.1GB) into "free space"

If I'm right, then my data (located on the rest part) have to be still somewhere. Somewhere in the nowhere of "free space". Goal : I would like to retrieve my things.

Thanks to my stupidity I may be able to learn something about forensic. But for now I am at the ground zero. I am currently downloading Caine linux live, but I'm not sure what I should do.

  • Is there a way to dump every bits located in "free space" and analyze it?
  • Or is there a way to recreate a LVM filesystem over free space WITHOUT formating anything? (I dont think so...)

For now, I try to learn basics from Basic Steps in Forensic Analysis of Unix Systems

Thx for any help.

migrated from security.stackexchange.com Dec 2 '15 at 11:31

This question came from our site for information security professionals.

  • As your /home folder is at the end of the disk, you might be lucky to restore it. /root might be lost. Tro to reconstruct a dummy partition table with e.g. cgsecurity.org/wiki/TestDisk and its deep-analyze mode. – jofel Dec 2 '15 at 11:39

Take a look at http://blog.boreas.ro/2007/10/digital-forensic-tools-imaging.html for a list of tools. Check the 'Data carving' section.

From the looks of it, you may end up using a file carving tool - such as https://github.com/sleuthkit/scalpel.

In theory, you should also start by imaging the disk (or at least be careful not to write to it again).

I'll be honest: you should be able to recover bits and pieces of files, based on patterns like file magic.. if you have a LOT Of data and aren't looking for anything specific, it's going to be challenging to put it all together without a file system structure in place.

Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.