Linux – Accidentally dd’ed an image to wrong drive / overwrote partition table + NTFS partition start


I screwed up and set the wrong output for dd when trying to copy a freenas ISO, overwriting the wrong external hard drive.

  • External drive is only used for data storage, system is entirely intact
  • Drive had a single NTFS partition filing the entire device (2TB WD elements)
  • Drive is EFI GPT
  • Drive was mounted at the time, with maybe a couple kB of data written/read after running dd
  • Drive is just a few months old and healthy (regular SMART / fs checks)
  • I have not reboot the OS (crunchbang)
  • /proc/partition still holds the correct information (and has been stored)
  • Have dd's output (records in / out / bytes)
  • testdrive did not find any partitions on quick or deep search
  • running photorec to recover the more important data (a couple recent plaintext files that hadn't been backed up yet). Vast majority of disk content (> 80%) is unnecessary media files.
  • Have Windows available on a separate computer

My current plan is to let photorec do it's thing, then recreate the mbr with gparted and use cfdisk to create another NTFS partition using the sector information from /sys/block/…/. Is that a good course of action (that is, a chance of success)? Or anything else I should try first?

Possibly relevant information:

dd if=FreeNAS-8.0.4-RELEASE-p3-x86.iso of=/dev/sdc:
194568+0 records in
194568+0 records out
99618816 bytes (100 MB) copied

grep . /sys/block/sdc/sdc*/{start,size}:

cat /proc/partitions:
major minor  #blocks  name
** Snipped **
   8       32 1953512448 sdc
   8       33 1953511424 sdc1

current fdisk -l output: 
WARNING: GPT (GUID Partition Table) detected on '/dev/sdc'! The util fdisk doesn't support GPT. Use GNU Parted.

Disk /dev/sdc: 2000.4 GB, 2000396746752 bytes
255 heads, 63 sectors/track, 243201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

Disk /dev/sdc doesn't contain a valid partition table

Best Answer

  • You can recreate your partition table with:

    sfdisk --no-reread /dev/sdc << EOF
    unit: sectors
    disk1 : start= 2048, size= 3907022848, Id=07, bootable
    disk2 : start=    0, size=          0, Id= 0
    disk3 : start=    0, size=          0, Id= 0
    disk4 : start=    0, size=          0, Id= 0

    It doesn't mean you'll be able to recover from your partition though, of course. But ntfsfix might be able to help.

  • Related Question