I'm stuck in a tricky problem. Context : Yesterday I made a cloning script for my raspberry pi that dd a whole running pi filesystem into a local sdcard on a computer connected through ethernet. It was late, I was starving and tired : I dd the pi into...
/dev/sda, my computer main fs, instead of
/dev/sdb (the sd card). Because everything was running in memory I didn't noticed the error before I reboot this morning... :cry:
So, instead of my 600go+ filesystem (which was partioned with
LVM, without encryption, running debian jessie, but I cant remember the initial partition sheme) I now get a 4go raspberry pi filesystem which is not even booting since its arm. ::cry::cry:cry:
(i am on amd64 btw)
My current partition sheme looks like :
SCSI1 (0,0,0) (sda) 640.1GB ATA Hitachi HTS54756 n° 1 primary 64.0MB fat16 n° 2 primary 4.0GB ext4 pri/log 636.1GB free space
or, in lsblk fashion :
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 4G 0 disk ├─sda1 8:1 0 64M 0 part /boot ├─sda2 8:2 0 4G 0 part /
As far as i remember, before it was something like :
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 640.1G 0 disk ├─sda1 8:1 0 2?M 0 part /boot ├─sda2 8:2 0 ?K 0 part └─sda5 8:5 0 ?G 0 part ├─mycomputer--vg-root 254:0 0 ?G 0 lvm / ├─mycomputer--vg-swap_1 254:1 0 ?G 0 lvm [SWAP] ├─mycomputer--vg-var 254:2 0 ?G 0 lvm /var ├─mycomputer--vg-tmp 254:3 0 ?M 0 lvm /tmp └─mycomputer--vg-home 254:4 0 ?G 0 lvm /home
Everything I need to get back was on
AFAIK, what the dd command did yesterday was :
- writing all the bits on the first 4go
- converting the "rest" (636.1GB) into "free space"
If I'm right, then my data (located on the rest part) have to be still somewhere. Somewhere in the nowhere of "free space". Goal : I would like to retrieve my things.
Thanks to my stupidity I may be able to learn something about forensic. But for now I am at the ground zero. I am currently downloading
Caine linux live, but I'm not sure what I should do.
- Is there a way to dump every bits located in "free space" and analyze it?
- Or is there a way to recreate a
LVMfilesystem over free space WITHOUT formating anything? (I dont think so...)
For now, I try to learn basics from Basic Steps in Forensic Analysis of Unix Systems
Thx for any help.