4

as embarrassing as it sounds I managed to dd a debian iso to an external hd instead of my usb pen drive.

now my 1.5 tb western digital has 1 700mb partition named debian and the rest is unallocated space.

if I understand correctly how dd works the first 700mb of data in the disc are lost since they have been overwritten.

is there any way to save the rest?

//the disk was ntfs partitioned

ndp
  • 185
  • 7
  • 1
    Before you do anything else, make a backup image of the hard drive. You may want to try several different recovery mechanisms and some of them are partially destructive. – David Schwartz May 19 '12 at 02:30

2 Answers2

1

This depends on how the data was stored on the disk. In most cases it will be fragmented, which means that a significant larger count of files could be corrupted as parts of them were overwritten.

To put it more precicely: Everything which had extents in the first 700MB will be (at least partly) corrupted.

However there are good chances to recover some of the files, check out testdisk and if this does not do it you might give photorec a try.

leepfrog
  • 488
  • 2
  • 9
  • can you please clarify the "how the data was stored on the disk" part? do you mean filesystem? – ndp May 18 '12 at 23:32
  • Yes, lets say for example you have several 5MB gaps in your filesystems first 700MB because the files which were stored there are deleted. You now write several 10MB files to the filesystem. The FS can fill the gaps first and as consequence you'd have at least a part of those files in the overwritten area of the disk. It depends on the type of file but in some cases (e.g solied archives) even corruption of a small part of the file can render it useless – leepfrog May 18 '12 at 23:55
  • thx for the info i'll try taking an image first and then operate on the image i'll post an ypdate once i find something useful – ndp May 19 '12 at 17:15
1

I would recommend downloading UFS Explorer to run a scan and see what's recoverable from the disk. As with most data recovery processes, make sure that you don't write anything else to the disk. UFS Explorer works on Mac and Linux, but I prefer running it from Windows. You should be able to scan and produce a list of files and possibly a folder structure. Also make sure that you have another disk or destination to recover to.

ewwhite
  • 194,921
  • 91
  • 434
  • 799