Recover partition table after DD command

I executed the following command from a Ubuntu live cd terminal (dont ask why).

 dd if=/dev/zero of=/dev/sdb2 bs=512 count=1

Where sdb2 is a NTFS partition (third partition) on a disk. Suffice to say it is now messed up. When I boot into windows 7, it does show me E drive but when I click on it it asks me to format it.

I am not ever sure what I did, did I mess up partition table or only the MFT? Is there any way to get the data back>

Shreedhar Kotekar

Posted 2012-11-29T09:10:54.077

Reputation: 131

1Did you allow the operation to complete? If so your data is toast, if not you might have something recoverable left on the disk. – Tog – 2012-11-29T11:18:26.833

TestDisk to the rescue... And considering you pretty much overwrote your NTFS partition with zeroes, you might want to look at this (possibly related) question: How to recover deleted files from (formatted) FAT32/NTFS drive in Linux? – Breakthrough – 2012-11-29T11:54:35.013

Answers

Contrary to some opinions, your data is perfectly recoverable.
Your dd command have actually cleared only sector 0 of the partition. MFT or other important data is untouched. This (first) sector is called boot sector (and despite it's name is present on every NTFS volume) and it stores critical partition information. Because it's so critical, NTFS stores a copy of it (at the end of volume for current versions). This means you can restore your partition using backup copy (of boot sector).

Testdisk do include an option to recover boot sector from backup and it's probably your best option*. Your steps should be:

Calm down.
If possible, make an image of affected disk. While not strictly required, it gives you additional level of protection (and lessens stress, which often is a cause for stupid mistakes even in simple tasks). You may use testdisk for that as well.
In testdisk, select your disk and partition type and then go to Advanced. Select damaged partition.
Select boot. You should see warning that primary boot sector is bust and copies do not match. Select backup bs.
Write data to disk when asked. Exit testdisk.
Reboot and check your partition.

**It is possible to restore it using dd only, but I would not recommend it unless you fancy it and have a good backup copy of your data.*

wmz

Posted 2012-11-29T09:10:54.077

Reputation: 6 132

Upvoting this nearly five-year-old answer merely for the simple values in suggesting "Calm down" and "Lessening stress...(to avoid) stupid mistakes in simple tasks." Great wisdom there. – David W – 2017-01-31T14:18:11.543

It could be very hard to recover your data, anyway in Ubuntu there's a package testdisk which contains some useful utilities to try to recover your data. You can install with

 sudo apt-get install testdisk

Another solution is to use a rescue live CD like this one SystemRescueCD. In the live CD there are many useful tools to try to recover your data.

Good luck! ;-)

Atropo

Posted 2012-11-29T09:10:54.077

Reputation: 1 513