Data recovery after Copying file to block device

Question

I have an NTFS formatted USB Hard drive that has my personal files backup. Today I mounted the drive to an Oracle Linux system and copied a regular file using the below command (please see below commands). By mistake I used the device file /dev/sdb1 during copy.

mount -t ntfs-3g /dev/sdb1 /sample
cp file1 /dev/sdb1

After this I unmounted the drive and connected to Windows system. Now Windows system complains that the drive need to be formatted and/or corrupted.

My question is: can we recover this drive without losing any personal data? How can I view the files available on this drive? Just mounting back to Linux system will show the files?

Answer 1

I answered to a very similar question on the Software Recommendations Q&A website.

The files you lost

Can we recover this drive without losing any personal data?

If by "personal data" you mean user generated data (excluding system files) then this might be the case, however only if your NTFS drive contained a OS (probably Windows). Assuming the file you wrote was not very big, you didn't overwrite more than the first 4-5 GB of the file system, which would have been occupied by Windows.

If your drive contained user files only, then it's almost sure you lost a few of them, to say the least.

Do not try to mount the partition

How can I view the files available on this drive? Just mounting back to Linux system will show the files?

No, don't do that. If you want to maximize the amount of data recovered, do not try to access the drive again using normal tools. Do not try to fix it using fsck or similar programs.

Clone the drive

You should first clone the drive and avoid attempting recovery on the original one. You can use ddrescue to perform a copy even if the drive has hardware damages (yours doesn't, but it is still a useful tool):

ddrescue /dev/sda /media/user/External/copy.img /media/user/External/status.log

See my answer to Raw copy from failed hard disk for a detailed explanation.

Restore files from the copy

Disclaimer: I am the author of RecuperaBit.

Now you can try to recover files from copy.img. If you ruined only the very beginning of the partition, let's say up to a few megabytes, you will probably be able to restore it with testdisk:

testdisk copy.img

The program searches for the backup NTFS boot sector and it tries to read the partition contents. You can list the files by pressing P after it has analyzed the drive and you are highlighting the right partition.

If this works, you can use the C button to copy one or more files/folders. The textual interface shows a step-by-step process which is not difficult to follow.

If the damage is severe and Testdisk cannot mount the partition, you can recover the files using RecuperaBit, but the process will take more time. RecuperaBit attempts to reconstruct file system structures and recover files. Currently it supports only NTFS. RecuperaBit attempts reconstruction of the directory structure regardless of:

• missing partition table
• unknown partition boundaries
• partially-overwritten metadata
• quick format

You can start the analysis with:

mkdir /media/user/External/recovered_files
cd [full path of recuperabit]
pypy main.py /media/user/External/copy.img -o /media/user/External/recovered_files -s /media/user/External/savefile.save

Then type recoverable and detect the id of your partition. Assuming it is 2, type:

restore 2 5
restore 2 -1

To restore the files that are reachable from the root (5) and those that are not (-1). Again, see my original answer for additional details and a few caveats that you may encounter.

Answer 2

To recover files you need to use file recovery software:
https://www.runtime.org/data-recovery-software.htm - for windows
is a good choice from old experience, there might be better ones nowadays.

As it is NTFS, I'd avoid Linux software for that particular partition.

And with all this; you always need enough extra disk space to save the recovered files while you're doing the recovery.

Answer 3

You definitively overwrote/corrupted the partition. No need trying to mount it elsewhere. It won't mount in Linux.

Whether or not you are lucky is highly dependent on the size of the file.

If the file is (very) small (KB), I would try in Windows software to try to fix the partition. For instance, http://www.ntfs.com/recovery-toolkit.htm

If the file is reasonably big, all bets are off. It would have erased the major blocks of the start of your filesystem, and whilst the files are still there, it won't be a simple task getting them back. Usually that involves specialised professional services that are (very) well paid.