1

I accidentally overwrote an NTFS partition with an iso image with the dd command. I am trying to recover NTFS partition with testdisk, but after disk selection (1.8TB), partition table type selection (intel) and analysis, I get the following current partition structure: partition structure

At this point I don't know what to do to go on and recover the NTFS partition that I don't see. Should I choose the HFS line? Please help me.

1
  • R-Studio Undelete is your best friend and bet. Aug 30, 2021 at 20:28

2 Answers 2

0

There pretty much isn't any way to properly fix this. Filesystems hate losing even small parts of themselves, not to mention overwriting hundreds of megabytes with dd.

What I like to do in such a case is determine how much data has been overwritten exactly - either from dd output or by comparing the iso image file with the on disk data (e.g. cmp datasource /dev/target). And then zero out the verified-to-be-lost segment.

Example: (use at your own risk - run all experiments on full disk copies or copy-on-write overlays)

# cmp isofile.img /dev/diska
cmp: EOF on isofile.img after byte 68157440, in line 266228
# dd bs=1 count=68157440 if=/dev/zero of=/dev/diska

# cmp isofile.img /dev/diskb
isofile.img /dev/diskb differ: byte 34603009, line 135095
# head -c $((34603009-1)) /dev/zero > /dev/diskb

Zeroing out the damaged area won't recover any of your data. But it will help stop recovery software from making wrong assumptions regarding block sizes and partition offsets, and avoid wasting time recovering data you're not interested in. It's better to have no data at all than completely bogus data that looks valid because it came from a valid image file.

In the future, make backups.

-1

Happened to me once. I used "TestDisk" to recover most of the files (dd was stopped when I recognized the error) There is an elaborate description here on how to recover lost files

2
  • Please do not post link-only-answers. Also the asker already is aware of testdisk. The information in the provided link do not seem to be related to a situation like in this question.
    – Hermann
    Aug 31, 2021 at 8:26
  • Sorry, I didn't know. Will be using links as additional source from now on.
    – kanehekili
    Aug 31, 2021 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .