how to recover data from my disk - I accidentally copied with dd an iso on it

Question

I wanted to create a bootable USB from an ISO image and I accidentally put as the output of the dd, instead of my usb drive, one of my hard disks. The ISO was 3,3 GB and my disk is 1TB! And it was almost full.

Can I at least restore the data that has not been overwritten? Right now i can't even mount it. I get this error:

Error mounting /dev/sdd1 at /media/main/UDF Volume: Command-line `mount -t "udf" -o "uhelper=udisks2,nodev,nosuid,uid=1000,gid=1000,iocharset=utf8,umask=0077" "/dev/sdd1" "/media/main/UDF Volume"' exited with non-zero exit status 32: mount: wrong fs type, bad option, bad superblock on /dev/sdd1,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

Also since i know which filesystem my disk used if i reformat it to this filesystem is there any chance i can mount it and retrieve the rest of the files?

Update: I tried testdisk. I got this error:

partition sector doesn't have the endmark 0xAA55

Anyway I am running testdisk quick search right now. But as far as I know this will only restore the MBR. Will I be able to retrieve my files? And what about the file structure?

Answer 1

First note that TestDisk generally attempts to recover the partition table, and its volumes, in addition to the MBR. if Testdisk is able to find the old partition in its searches, that is definitely the best possible solution, as it will restore files and structure.

Unfortunately since you overwrote the partition table and at least your first volumes file system indexes, you will probably not be able to recover the whole partition. You will have to try a tool like PhotoRec, which will scan the hard disk for recognized file types. They can usually be recovered, but their names and folder paths will be lost (since that's stored in the overwritten file system indexes.)

I know this goes without saying, but be sure to restore any files you recover to another physical disk, so you don't overwrite any other data.

Answer 2

In general, in situations of "how do I recover my disk", I think you should follow some steps:

1 - copy your disk: take another drive, with the same size, and do a 'dd' again to copy it. It the files that were on it are so important to you, they worth you spending some time and $ to buy another disk (of, at least, the same size) and make a copy of it.

2 - take the lost disk, put it aside, and only work in the new copy. That way, if do something wrong, you'll be exactly where you were before.

3 - Since you wrote 3 GB to the disk, you overwrote all those structural beginning of it. Recovering the MBR will do almost nothing for you. You would need that structure that says where each file is, how long it is, etc. Each filesystem FAT, ext2, etc., has it way of doing it. But they probably were overwritten, so hardly any program will be able to read it.

4 - what's left for you are programs that will read every block of your disk, see if they look like some know file, and then try to recover it based on that.

PhotoRec does that.

Recuva Free might do that, depending on your filesystem

Stellar Phoenix

R-studio would deal with ext2, too.