1

Hi I have an Iomega HD for mac. I was writing a ubuntu server image to another drive but accidentally selected my 500GB Iomega with my files on it. The command I ran was:

sudo dd if=/Users/myuser/Desktop/ubuntu/ubuntuserver.img of=/dev/rdisk1 bs=1m

this shouldve been another disk.

I have downloaded testdisk but have no idea how to recover using it.

what are my best options for retrieving the data?

Improve this question
6
  • 3
    Do you have a backup?
    – Nicole Hamilton
    Feb 18, 2013 at 2:20
  • just ran photoRec i am starting to see some of my files being recovered!
    – arrowill12
    Feb 18, 2013 at 3:42
  • You should have indicated that you aborted the "dd" part way through then !!! A fully "dd"'d disk will leave previous little to recover. Good on you for using photorec though !
    – davidgo
    Feb 18, 2013 at 6:07
  • What is the size of the ubuntu server image file?
    – wnrph
    Feb 18, 2013 at 9:01
  • I didnt abort the "dd" the image is only 722 MB
    – arrowill12
    Feb 18, 2013 at 14:58

1 Answer 1

Reset to default
5

Quite simply, its probably impossible if dd finished its work -if you stopped it partway, any data that wasn't overwritten should be recoverable. Testdisk is most useful when a system got formatted - and this usually involves 'marking' sectors as not in use, rather than erasing them. With modern drives, despite what the guttmann paper says, overwriting the data is extremely likely to leave data irrecoverable. DD overwrites data and as such, there's no practical way you can recover your data, short of recovering off backups.

Unfortunately, forensics is tricky. photorec is a good start, but you probably need to try things like scalpel and foremost too. If the data has value, its probably worth getting a quote from a professional drive recovery company too.

Improve this answer
2
  • Guttman says that it might be possible to get the overwritten data back, with a massive investment (a few kilobucks per megabyte, at least).
    – vonbrand
    Feb 18, 2013 at 4:32
  • 2
    That was assuming older data densities. I suppose if he'd just started running dd, and stopped it in time, testdisk might help, but thats a different scenario from 'I overwrote my entire drive with dd'
    – Journeyman Geek ♦
    Feb 18, 2013 at 5:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .