Data recovery after dd on a sda partition
Multi tool use
I had installed opensuse in UEFI mode in my computer but having a legacy Windows so it did not appear in boot menu. Following a weird tutorial on the internet I dd the Windows partition of my sda.
I used
dd if="some img" of=/dev/sdaX bs=4m
with X being the partition. The img was just some KB. I am aware, don't know whether it is true or not, that dd starts writing from the first block of the device and therefore I think it just overwrote the partition information of the first KB of the partition block and therefore the system doesn't know what file system it is and therefore cannot mount it. But I don't know if dd has wiped all the remaining data. Hence my question is whether there is a way to recover my data from that particular partition.
filesystems mount partition data-recovery dd
edited Feb 24 at 18:09
RalfFriedl
5,4303925
asked Feb 24 at 17:42
Weijie ChenWeijie Chen
991
add a comment |
I had installed opensuse in UEFI mode in my computer but having a legacy Windows so it did not appear in boot menu. Following a weird tutorial on the internet I dd the Windows partition of my sda.
I used
dd if="some img" of=/dev/sdaX bs=4m
with X being the partition. The img was just some KB. I am aware, don't know whether it is true or not, that dd starts writing from the first block of the device and therefore I think it just overwrote the partition information of the first KB of the partition block and therefore the system doesn't know what file system it is and therefore cannot mount it. But I don't know if dd has wiped all the remaining data. Hence my question is whether there is a way to recover my data from that particular partition.
filesystems mount partition data-recovery dd
edited Feb 24 at 18:09
RalfFriedl
5,4303925
asked Feb 24 at 17:42
Weijie ChenWeijie Chen
991
If you did not poweroff or reboot your computer, there is a chance that you can get things correctly according to the accepted answer to this question at AskUbuntu: Accidentally did dd /dev/sda. Otherwise (if you have powered off or rebooted the computer) some other answer over there can be useful.
– sudodus
Feb 24 at 19:02
add a comment |
I had installed opensuse in UEFI mode in my computer but having a legacy Windows so it did not appear in boot menu. Following a weird tutorial on the internet I dd the Windows partition of my sda.
I used
dd if="some img" of=/dev/sdaX bs=4m
with X being the partition. The img was just some KB. I am aware, don't know whether it is true or not, that dd starts writing from the first block of the device and therefore I think it just overwrote the partition information of the first KB of the partition block and therefore the system doesn't know what file system it is and therefore cannot mount it. But I don't know if dd has wiped all the remaining data. Hence my question is whether there is a way to recover my data from that particular partition.
filesystems mount partition data-recovery dd
edited Feb 24 at 18:09
RalfFriedl
5,4303925
asked Feb 24 at 17:42
Weijie ChenWeijie Chen
991
I had installed opensuse in UEFI mode in my computer but having a legacy Windows so it did not appear in boot menu. Following a weird tutorial on the internet I dd the Windows partition of my sda.
I used
dd if="some img" of=/dev/sdaX bs=4m
with X being the partition. The img was just some KB. I am aware, don't know whether it is true or not, that dd starts writing from the first block of the device and therefore I think it just overwrote the partition information of the first KB of the partition block and therefore the system doesn't know what file system it is and therefore cannot mount it. But I don't know if dd has wiped all the remaining data. Hence my question is whether there is a way to recover my data from that particular partition.
filesystems mount partition data-recovery dd
filesystems mount partition data-recovery dd
edited Feb 24 at 18:09
RalfFriedl
5,4303925
asked Feb 24 at 17:42
Weijie ChenWeijie Chen
991
edited Feb 24 at 18:09
RalfFriedl
5,4303925
asked Feb 24 at 17:42
Weijie ChenWeijie Chen
991
edited Feb 24 at 18:09
RalfFriedl
5,4303925
edited Feb 24 at 18:09
RalfFriedl
5,4303925
edited Feb 24 at 18:09
RalfFriedl
5,4303925
5,4303925
asked Feb 24 at 17:42
Weijie ChenWeijie Chen
991
asked Feb 24 at 17:42
Weijie ChenWeijie Chen
991
asked Feb 24 at 17:42
Weijie ChenWeijie Chen
991
991
If you did not poweroff or reboot your computer, there is a chance that you can get things correctly according to the accepted answer to this question at AskUbuntu: Accidentally did dd /dev/sda. Otherwise (if you have powered off or rebooted the computer) some other answer over there can be useful.
– sudodus
Feb 24 at 19:02
add a comment |
If you did not poweroff or reboot your computer, there is a chance that you can get things correctly according to the accepted answer to this question at AskUbuntu: Accidentally did dd /dev/sda. Otherwise (if you have powered off or rebooted the computer) some other answer over there can be useful.
– sudodus
Feb 24 at 19:02
If you did not poweroff or reboot your computer, there is a chance that you can get things correctly according to the accepted answer to this question at AskUbuntu: Accidentally did dd /dev/sda. Otherwise (if you have powered off or rebooted the computer) some other answer over there can be useful.
– sudodus
Feb 24 at 19:02
If you did not poweroff or reboot your computer, there is a chance that you can get things correctly according to the accepted answer to this question at AskUbuntu: Accidentally did dd /dev/sda. Otherwise (if you have powered off or rebooted the computer) some other answer over there can be useful.
– sudodus
Feb 24 at 19:02
add a comment |
2 Answers
2
active
oldest
votes
If your img was of a partition/file-system then sdaX is now a functioning copy.
If your IMG was something else "just some KB" (do you mean is was less than 1MB in size?) then you likely don't have your data anymore.
You can check if IMG is a valid file-system by mounting it with a loopback device.
You can use PhotoRec to attempt recover of data from sdaX (assuming you did not zero it)
answered Feb 24 at 18:15
user1133275user1133275
3,625823
add a comment |
Thedd program starts to write at the start of the partition, unless you specify otherwise. It also just writes the data from the source to the destination, it does't fill the destination partition if it is larger than the source.
So if your source file was just a few kB, than most or all of your data should still be present. The problem is to find out where on the partition it is.
First you should make a backup of the whole partition.
If those few kB were really just a few kB, it should be possible to create a new file system of exactly the same type in this partition and then restore the rest after those few kB from the backup. The start of a filesystem often contains general information about the filesystem and is mostly constant. Many filesystems also have backup blocks of important data structures. You may be able to recover most of your data.
answered Feb 24 at 18:16
RalfFriedlRalfFriedl
5,4303925
If there is a backup there is no need to attempt to connect just the start of the file system with the data. It would result in an unclean FS anyway.
– user1133275
Feb 24 at 18:20
@user1133275 If there is a backup then it would have been used, so no need for a question here. What I suggested will not lead to a clean filesystem, but depending on how much was left intact might enable the retrieval of most of the data, including file names and directory structure.
– RalfFriedl
Feb 24 at 18:24
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f502729%2fdata-recovery-after-dd-on-a-sda-partition%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
If your img was of a partition/file-system then sdaX is now a functioning copy.
If your IMG was something else "just some KB" (do you mean is was less than 1MB in size?) then you likely don't have your data anymore.
You can check if IMG is a valid file-system by mounting it with a loopback device.
You can use PhotoRec to attempt recover of data from sdaX (assuming you did not zero it)
answered Feb 24 at 18:15
user1133275user1133275
3,625823
add a comment |
If your img was of a partition/file-system then sdaX is now a functioning copy.
If your IMG was something else "just some KB" (do you mean is was less than 1MB in size?) then you likely don't have your data anymore.
You can check if IMG is a valid file-system by mounting it with a loopback device.
You can use PhotoRec to attempt recover of data from sdaX (assuming you did not zero it)
answered Feb 24 at 18:15
user1133275user1133275
3,625823
add a comment |
If your img was of a partition/file-system then sdaX is now a functioning copy.
If your IMG was something else "just some KB" (do you mean is was less than 1MB in size?) then you likely don't have your data anymore.
You can check if IMG is a valid file-system by mounting it with a loopback device.
You can use PhotoRec to attempt recover of data from sdaX (assuming you did not zero it)
answered Feb 24 at 18:15
user1133275user1133275
3,625823
If your img was of a partition/file-system then sdaX is now a functioning copy.
If your IMG was something else "just some KB" (do you mean is was less than 1MB in size?) then you likely don't have your data anymore.
You can check if IMG is a valid file-system by mounting it with a loopback device.
You can use PhotoRec to attempt recover of data from sdaX (assuming you did not zero it)
answered Feb 24 at 18:15
user1133275user1133275
3,625823
answered Feb 24 at 18:15
user1133275user1133275
3,625823
answered Feb 24 at 18:15
user1133275user1133275
3,625823
answered Feb 24 at 18:15
user1133275user1133275
3,625823
3,625823
add a comment |
add a comment |
Thedd program starts to write at the start of the partition, unless you specify otherwise. It also just writes the data from the source to the destination, it does't fill the destination partition if it is larger than the source.
So if your source file was just a few kB, than most or all of your data should still be present. The problem is to find out where on the partition it is.
First you should make a backup of the whole partition.
If those few kB were really just a few kB, it should be possible to create a new file system of exactly the same type in this partition and then restore the rest after those few kB from the backup. The start of a filesystem often contains general information about the filesystem and is mostly constant. Many filesystems also have backup blocks of important data structures. You may be able to recover most of your data.
answered Feb 24 at 18:16
RalfFriedlRalfFriedl
5,4303925
If there is a backup there is no need to attempt to connect just the start of the file system with the data. It would result in an unclean FS anyway.
– user1133275
Feb 24 at 18:20
@user1133275 If there is a backup then it would have been used, so no need for a question here. What I suggested will not lead to a clean filesystem, but depending on how much was left intact might enable the retrieval of most of the data, including file names and directory structure.
– RalfFriedl
Feb 24 at 18:24
add a comment |
Thedd program starts to write at the start of the partition, unless you specify otherwise. It also just writes the data from the source to the destination, it does't fill the destination partition if it is larger than the source.
So if your source file was just a few kB, than most or all of your data should still be present. The problem is to find out where on the partition it is.
First you should make a backup of the whole partition.
If those few kB were really just a few kB, it should be possible to create a new file system of exactly the same type in this partition and then restore the rest after those few kB from the backup. The start of a filesystem often contains general information about the filesystem and is mostly constant. Many filesystems also have backup blocks of important data structures. You may be able to recover most of your data.
answered Feb 24 at 18:16
RalfFriedlRalfFriedl
5,4303925
If there is a backup there is no need to attempt to connect just the start of the file system with the data. It would result in an unclean FS anyway.
– user1133275
Feb 24 at 18:20
@user1133275 If there is a backup then it would have been used, so no need for a question here. What I suggested will not lead to a clean filesystem, but depending on how much was left intact might enable the retrieval of most of the data, including file names and directory structure.
– RalfFriedl
Feb 24 at 18:24
add a comment |
Thedd program starts to write at the start of the partition, unless you specify otherwise. It also just writes the data from the source to the destination, it does't fill the destination partition if it is larger than the source.
So if your source file was just a few kB, than most or all of your data should still be present. The problem is to find out where on the partition it is.
First you should make a backup of the whole partition.
If those few kB were really just a few kB, it should be possible to create a new file system of exactly the same type in this partition and then restore the rest after those few kB from the backup. The start of a filesystem often contains general information about the filesystem and is mostly constant. Many filesystems also have backup blocks of important data structures. You may be able to recover most of your data.
answered Feb 24 at 18:16
RalfFriedlRalfFriedl
5,4303925
Thedd program starts to write at the start of the partition, unless you specify otherwise. It also just writes the data from the source to the destination, it does't fill the destination partition if it is larger than the source.
So if your source file was just a few kB, than most or all of your data should still be present. The problem is to find out where on the partition it is.
First you should make a backup of the whole partition.
If those few kB were really just a few kB, it should be possible to create a new file system of exactly the same type in this partition and then restore the rest after those few kB from the backup. The start of a filesystem often contains general information about the filesystem and is mostly constant. Many filesystems also have backup blocks of important data structures. You may be able to recover most of your data.
answered Feb 24 at 18:16
RalfFriedlRalfFriedl
5,4303925
answered Feb 24 at 18:16
RalfFriedlRalfFriedl
5,4303925
answered Feb 24 at 18:16
RalfFriedlRalfFriedl
5,4303925
answered Feb 24 at 18:16
RalfFriedlRalfFriedl
5,4303925
5,4303925
If there is a backup there is no need to attempt to connect just the start of the file system with the data. It would result in an unclean FS anyway.
– user1133275
Feb 24 at 18:20
@user1133275 If there is a backup then it would have been used, so no need for a question here. What I suggested will not lead to a clean filesystem, but depending on how much was left intact might enable the retrieval of most of the data, including file names and directory structure.
– RalfFriedl
Feb 24 at 18:24
add a comment |
If there is a backup there is no need to attempt to connect just the start of the file system with the data. It would result in an unclean FS anyway.
– user1133275
Feb 24 at 18:20
@user1133275 If there is a backup then it would have been used, so no need for a question here. What I suggested will not lead to a clean filesystem, but depending on how much was left intact might enable the retrieval of most of the data, including file names and directory structure.
– RalfFriedl
Feb 24 at 18:24
If there is a backup there is no need to attempt to connect just the start of the file system with the data. It would result in an unclean FS anyway.
– user1133275
Feb 24 at 18:20
If there is a backup there is no need to attempt to connect just the start of the file system with the data. It would result in an unclean FS anyway.
– user1133275
Feb 24 at 18:20
@user1133275 If there is a backup then it would have been used, so no need for a question here. What I suggested will not lead to a clean filesystem, but depending on how much was left intact might enable the retrieval of most of the data, including file names and directory structure.
– RalfFriedl
Feb 24 at 18:24
@user1133275 If there is a backup then it would have been used, so no need for a question here. What I suggested will not lead to a clean filesystem, but depending on how much was left intact might enable the retrieval of most of the data, including file names and directory structure.
– RalfFriedl
Feb 24 at 18:24
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f502729%2fdata-recovery-after-dd-on-a-sda-partition%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
YBn vpEKeV0SMw06,4UcXWwRUMe,Dug,S
If you did not poweroff or reboot your computer, there is a chance that you can get things correctly according to the accepted answer to this question at AskUbuntu: Accidentally did dd /dev/sda. Otherwise (if you have powered off or rebooted the computer) some other answer over there can be useful.
– sudodus
Feb 24 at 19:02