I answered to a very similar question on the Software Recommendations Q&A website.
The files you lost
Can we recover this drive without losing any personal data?
If by "personal data" you mean user generated data (excluding system files) then this might be the case, however only if your NTFS drive contained a OS (probably Windows). Assuming the file you wrote was not very big, you didn't overwrite more than the first 4-5 GB of the file system, which would have been occupied by Windows.
If your drive contained user files only, then it's almost sure you lost a few of them, to say the least.
Do not try to mount the partition
How can I view the files available on this drive? Just mounting back to Linux system will show the files?
No, don't do that. If you want to maximize the amount of data recovered, do not try to access the drive again using normal tools. Do not try to fix it using
fsck or similar programs.
Clone the drive
You should first clone the drive and avoid attempting recovery on the original one. You can use
ddrescue to perform a copy even if the drive has hardware damages (yours doesn't, but it is still a useful tool):
ddrescue /dev/sda /media/user/External/copy.img /media/user/External/status.log
See my answer to Raw copy from failed hard disk for a detailed explanation.
Restore files from the copy
Disclaimer: I am the author of RecuperaBit.
Now you can try to recover files from
copy.img. If you ruined only the very beginning of the partition, let's say up to a few megabytes, you will probably be able to restore it with
The program searches for the backup NTFS boot sector and it tries to read the partition contents. You can list the files by pressing
P after it has analyzed the drive and you are highlighting the right partition.
If this works, you can use the
C button to copy one or more files/folders. The textual interface shows a step-by-step process which is not difficult to follow.
If the damage is severe and Testdisk cannot mount the partition, you can recover the files using RecuperaBit, but the process will take more time. RecuperaBit attempts to reconstruct file system structures and recover files. Currently it supports only NTFS. RecuperaBit attempts reconstruction of the directory structure regardless of:
- missing partition table
- unknown partition boundaries
- partially-overwritten metadata
- quick format
You can start the analysis with:
cd [full path of recuperabit]
pypy main.py /media/user/External/copy.img -o /media/user/External/recovered_files -s /media/user/External/savefile.save
recoverable and detect the id of your partition. Assuming it is
restore 2 5
restore 2 -1
To restore the files that are reachable from the root (
5) and those that are not (
-1). Again, see my original answer for additional details and a few caveats that you may encounter.
cpcommand, it was running that
cpcommand as root. Don't run commands as root when it isn't necessary. If you'd used your normal account, permissions would have prevented you from screwing up.