1
Hi I have an Iomega HD for mac. I was writing a ubuntu server image to another drive but accidentally selected my 500GB Iomega with my files on it. The command I ran was:
sudo dd if=/Users/myuser/Desktop/ubuntu/ubuntuserver.img of=/dev/rdisk1 bs=1m
this shouldve been another disk.
I have downloaded testdisk but have no idea how to recover using it.
what are my best options for retrieving the data?
arrowill12
Posted 2013-02-18T02:09:49.283
Reputation: 111
5
Quite simply, its probably impossible if dd finished its work -if you stopped it partway, any data that wasn't overwritten should be recoverable. Testdisk is most useful when a system got formatted - and this usually involves 'marking' sectors as not in use, rather than erasing them. With modern drives, despite what the guttmann paper says, overwriting the data is extremely likely to leave data irrecoverable. DD overwrites data and as such, there's no practical way you can recover your data, short of recovering off backups.
Unfortunately, forensics is tricky. photorec is a good start, but you probably need to try things like scalpel and foremost too. If the data has value, its probably worth getting a quote from a professional drive recovery company too.
Journeyman Geek
Posted 2013-02-18T02:09:49.283
Reputation: 119 122
Guttman says that it might be possible to get the overwritten data back, with a massive investment (a few kilobucks per megabyte, at least). – vonbrand – 2013-02-18T04:32:03.227
2That was assuming older data densities. I suppose if he'd just started running dd, and stopped it in time, testdisk might help, but thats a different scenario from 'I overwrote my entire drive with dd' – Journeyman Geek – 2013-02-18T05:29:23.857
3Do you have a backup? – Nicole Hamilton – 2013-02-18T02:20:45.653
just ran photoRec i am starting to see some of my files being recovered! – arrowill12 – 2013-02-18T03:42:04.890
You should have indicated that you aborted the "dd" part way through then !!! A fully "dd"'d disk will leave previous little to recover. Good on you for using photorec though ! – davidgo – 2013-02-18T06:07:16.100
What is the size of the ubuntu server image file? – artistoex – 2013-02-18T09:01:06.490
I didnt abort the "dd" the image is only 722 MB – arrowill12 – 2013-02-18T14:58:42.873
possible duplicate of Recovering Ubuntu after filesystem was overwritten using dd
– Ƭᴇcʜιᴇ007 – 2014-04-20T16:08:52.910