Is there a way to recover files from a storage device partially overwritten with dd?
I'm an idiot, I was writing an image to a USB drive using dd when instead of typing /dev/sdb I typed /dev/sdd and wrote the 135mb image to my 750gb External Hardrive full of files. Is there ANY possibility of recovering the files or did dd completely zero out the drive? Please help, as this is one of the lowest points of my life EVER.
dd finished writing the 135mb image in 5 seconds, so I didn't have a chance to stop it. By the time I knew what happened to was too late. The command was as follows:
sudo dd if=generic.img of=/dev/sdd bs=1M
EDIT2: The External Harddrive's filesystem was FAT32(I've had the drive for awhile and FAT32 was the most Universal FS at the time). I also have a 2TB drive I just got which I was planning on moving most of the files to from the 750gb, If needed I can use it to transfer the Recovered files to.
Solution 1:
When a drive has been accidentally overwritten you will need Data Recovery Tools to restore the remainders of your data. When this has occured from running dd for a 135 MB image then those parts of your drive are definitely gone and can not be rescued.
By installing
TestDisk
you may be able to recover part of your files. Included in the TestDisk suite you will also find the tool PhotoRec that helps to recover individual files even in the case the partitions can not be restored by testdisk or the drive itself has a hardware defect.
TestDisk/PhotoRec can also be run on an image of your drive (as was also suggested by this answer)
Solution 2:
You can try to recover files from your HD with foremost. Foremost will try to recover only certain types of files (jpg, doc, rar, zip, htm, bmp, and quite a few others), though, so I believe it won't help to recover everything.
Basically, what I would try to do is:
sudo foremost -v -t all -i /dev/sdd -o ~/DISK_RECOVERY_FOLDER
While the command scans all your sdd HD, cross your fingers (even though it will take quite a bit)
Optionally, you can dd your whole 750Gb HD to some greater drive with enough space and run foremost on that image file, instead (not that foremost writes it, though.... just for speed if you want to run several recovery tools on that image). Something like_
sudo dd -if=/dev/sdd -of=image.dd
and change the foremost command to:
sudo foremost -v -t all -i image.dd -o ~/DISK_RECOVERY_FOLDER
Hope this helps
Solution 3:
DD AFAIK writes the files contiguously so you lost whatever was in the first 750 mb of your disk.
I think the first thing to do would be try and backup the whole image if possible so that if you try one tool and it changes the file systems you can go to another tool and see if it gets better results.
To backup the whole disk image you might need another 750gb harddrive to copy the image to. I would use a live CD/USB of clonezilla and copy the files to backup the whole disk image.
One of the tools I had a lot of successful with recovering partition tables is testdisk . I would recommend using the System Rescue CD and boot using it using a CD or a USB. One thing to remember boot with 64-bit system rescue if you had a 64-bit operating system installed, because if the / partition is fully available it will possible to chroot and fix the setup only using similar kernels.
Boot into system rescue CD and run testdisk.Using the menu choose analyse and see if it find the partition table. I would think you would need to run the deeper search for to find the partition table by brute force and it might not succeed in detecting the partition type of the first partition. So give it a name and try recover the partition tables. and then backup recovered files.
Edit: Now finding that it is fat32, I think it would be easier that what I thought as there would be many fat recovery tools. You can use them to generate the fat table and the directories structure and specific file could be recovered using tools like photorec. ubuntu rescue remix has photorec and testdisk both.
Edit: added information for cloning disk contents of the hard drive.