recovering ext4 partition after dd'ing over start of HD
I finally managed to fix this. Just for the record here's how I did it. Part of the solution I found here and it involves knowing the settings used to create the filesystem (I was pretty sure I didn't change the defaults).
Basically I first had to fix the partition table to reflect what I actually had there (I used testdisk
for this but parted
, cfdisk
or fdisk
should work fine as well). I just removed the wrong partitions and replaced by a single ext4 type partition covering the whole disk with the correct CHS values.
The rest is mostly from the link at start (read it for details) but basically I ran mke2fs -n /dev/xxx
to find the positions for the superblocks backup. Then used the last backup closest to the end of the disk (only the ones at the start of the disk had been overwritten with dd) to run fsck. This generated a lot of errors but fsck has a -y
option (not the same as -a
).
$ sudo e2fsck -a -b backup_block_number /dev/xxx
I thought this had not worked because I couldn't see any files but actually they had all been saved to the lost+found
directory.
So in the end I did salvage most of my files while keeping their filenames and directory structure. Hope this may help others in the future.
Related videos on Youtube
carandraug
I learned how to program during my PhD, shortly after changing to Linux, by poking into the source of the programs I used. I mostly program in Octave and C++ for image processing, Python for hardware control and creating user interface, and perl for bioinformatics. For full disclosure, I am an Octave developer and maintainer of Octave's image package.
Updated on September 18, 2022Comments
-
carandraug over 1 year
I accidentally used
dd
and wrote over the first 208MB of my external disk. What I wrote over is a partition on its own (Debian nestinstaller) so what I see now is not my old (now damaged) ext4 partition but another smaller partition. This limits the tools and advices I could follow.My plan was to recreate the partition table with
testdisk
and then fix everything with the backup superblocks as described here. I'd lose the first 208MB but that's ok compared to the other 300GB of data in there. Something like the following:mke2fs -n /dev/sdb1 # doesn't work because sdb1 is the 208MB new partition testdisk ... # used this to create new correct partition table mke2fs -n /dev/sdb1 # now works fine, get backup superblock positions e2fsck -b backup_position -y /dev/sdb1 # returns many errors hence the -y
However, I have been unable to recover anything. I used
testdisk
to write a new partition table that matched what I had before. When I then run e2fsck I get many different errors. I get a filesystem after that but it's completely empty, no files.The lost+found directory is full of files (recovered ones I think) but I need to recover the directory tree, not just the files. I need the filename and previous directories to know what the files are (microscope images, mass spec data, etc.. Without the names and the directories where they were, they mean nothing).
I got another HD exactly the same and made a copy of the whole HD with
dd
so I can experiment recovery without losing anything. Any advice?-
Admin over 11 yearsDo you have any idea how many partitions you did have before?
-
Admin over 11 years@Cougar yes. I had a single ext4 primary partition spanning the whole disk.
-
Admin over 11 yearsFirst I would suggest to recreate the partition with fdisk or any other low-level partition tool. How to recover your ext4 after that is shown here: link
-
Admin over 11 years@Cougar that's actually the link I followed to try to recover the partition. The difference is that I used
testdisk
to recreate the partition. I will try withfdisk
. -
Admin over 11 years@Cougar using
fdisk
I couldn't even usee2fsck
as it wouldn't find the superblock backups. I think the problem was that I couldn't edit the CHS (the new partition set it to 64 but should be 255)
-