Accidentally overwrote wrong disk with dd, how to recover?

Question

I wanted to dd an image from sdb to sdc, but because one hour before I had set up things differently, I just copied the same command:

dd if=/home/user/Downloads/ubuntu.iso  of=/dev/rsdb bs=2M; sync

sda = internal hard drive
sdb = USB hard drive (booted from right now)
sdc = USB stick

There are 3 partitions on the hard drive I've booted from, I guess the other 2 are in read only mode, and the error in shell as I tried two times:

568328192 bytes (568 MB) copied, 38,5818 s, 14,7 MB/s
dd: error writing ‘/dev/rsdb’: No space left on device
715128832 bytes (715 MB) copied, 17,1752 s, 41,6 MB/s

Now I realized I overwrote 1GB over the hard drive I'm booted from (using rsdb). I haven't turned off my computer. Will I loose all data on this drive? Can I recover anything now?

Here’s my /proc/partitions:

   8        0  156290904 sda
   8        1  154218496 sda1
   8        2          1 sda2
   8        5    2069504 sda5
   8       16  244198582 sdb
   8       17   31457280 sdb1
   8       18   20971520 sdb2
   8       19  191768576 sdb3
   8       32    2011136 sdc
   8       33    2011135 sdc1

Solution 1

You have destroyed the first ~1 GB, which covers the partition table and the first partition's file/directory list. You can still rebuild the partition table and find sdb2 & sdb3 untouched, though.

Run this script from a terminal, and write down the start/size/end numbers it reports (just in case):

for part in /sys/class/block/sdb[0-9]*; do
    num=$(<$part/partition)
    start=$(<$part/start)
    size=$(<$part/size)
    end=$((start+size-1))
    echo "partition $num: start $start, size $size, end $end"
done

Then use parted /dev/sdb or fdisk /dev/sdb to manually create the matching partitions. For example, if it prints:

partition 1: start 2048, size 204800, end 206847

then you could use:

parted /dev/sdb mkpart primary 2048s 206847s

(note the s unit at the end)

Solution 2

You can recover your data using TestDisk (photorec)

TestDisk is OpenSource software and is licensed under the terms of the GNU General Public License (GPL v2+).

TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.

TestDisk can

Fix partition table, recover deleted partition

Recover FAT32 boot sector from its backup

Rebuild FAT12/FAT16/FAT32 boot sector

Fix FAT tables

Rebuild NTFS boot sector

Recover NTFS boot sector from its backup

Fix MFT using MFT mirror

Locate ext2/ext3/ext4 Backup SuperBlock

Undelete files from FAT, exFAT, NTFS and ext2 filesystem Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions. TestDisk has features for both novices and experts. For those who know little or nothing about data recovery techniques, TestDisk can be used to collect detailed information about a non-booting drive which can then be sent to a tech for further analysis. Those more familiar with such procedures should find TestDisk a handy tool in performing onsite recovery.

Boot from Linux live usb.

To install TestDisk type:

 sudo apt-get install testdisk

to run TestDisk

sudo testdisk

There are a tuto :TestDisk_Step_By_Step

Comments

[Daniel B]

Turning off your PC won’t make any difference.

[user1861388]

Given how dd works, yes I think you are right. But I added details, some partitions are in read only mode, and I can still see the data. Am I am lucky to say that only the free space was overwritten ?

[Daniel B]

Partitions and filesystems don’t matter to dd. You’re most likely seeing cached data. Seeing how you also overwrote the partition table, you don’t even know exactly where those partitions were. Also, what operating system are you using? What kind of device is rsdb supposed to be?

[Daniel B]

If you haven’t rebooted yet, please provide /proc/partitions.

[user1861388]

When all hard drives are installed: sda is Ubuntu one partition. sdb1 sdb2 are also two versions of Linux and sdb3 is data. sdc was the drive supposed to be the target of dd. (But one hour before it was different setup and it was correct to use the usb stick as sdb)

[user1861388]

8 0 156290904 sda -- 8 1 154218496 sda1 -- 8 2 1 sda2 -- 8 5 2069504 sda5 -- 8 16 244198582 sdb -- 8 17 31457280 sdb1 -- 8 18 20971520 sdb2 -- 8 19 191768576 sdb3 -- 8 32 2011136 sdc -- 8 33 2011135 sdc1 --

[Ramhound]

Update your question. Comments are not meant for actual information that requires it to be formatted

[makgun]

About 5 months ago I 've had same issue. I used TestDisk to find others partitions and write new mbr to the disk. But now I have learnt the manually way to do this. But if you have not multiple partition, it won't work. For example if your hdd (or USB) has 200 gb and you created 3( or 2) partitions and your overwrited data not bigger than the first partiton has. You will recover all others partitions but not first. If you overwrite bigger than the first partition but not bigger than third one, you probably will recover the after second partitions. If I am wrong, please just reply me. So sorr

[makgun]

so sorry for bad English