I stupidly used dd if=/dev/zero of=/dev/sdb bs=512 intending to do /dev/sdc.

I have a 1 terabyte USB drive on /dev/sdb. It is/was formated exfat.

The two partitions are showing in /proc/partitions as:

   8       17     131072 sdb1
   8       18  976629760 sdb2

I haven't rebooted or removed the drive.

Can I somehow re-invent the boot sector's 512 bytes?

What tools/methods might I use to do it? As it's exfat it presents weird linux issues.

mount shows:

fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
/dev/sdb2 on /media/keith/tera type fuseblk (rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other,blksize=4096,uhelper=udisks2)

Am I toast? Can testdisk or gparted help? Gee it's just a measly 512 bytes right?

I just realized there was no count=1 so it kept writing till I hit Ctrl-C. Which for me was immediate but for a processor...well...OUCH!

I also just found this in a terminal history:

Disk /dev/sdb: 931.5 GiB, 1000204885504 bytes, 1953525167 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: F3A19FB9-E01F-40BC-ADFE-4F97133EA6CF

Device      Start        End    Sectors   Size Type
/dev/sdb1      34     262177     262144   128M Microsoft reserved
/dev/sdb2  264192 1953523711 1953259520 931.4G Microsoft basic data

Can I use this through testdisk to recontstruct the partions? Testdisk has come up with the following:

Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
>D MS Data                       63 1953520127 1953520065
 D MS Data               1387348323 1387351202       2880 [SPINRITE V6]
 D MS Data               1387643135 1387646014       2880 [SPINRITE V6]

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB

But can Linux recreate the correct partition types? I seem to remember originally formatting this drive on a Windows box.

| |

Before trying to recover try to squeeze partition information für sdb out of your linux installation which might still be in RAM. Maybe lsblk would be a candidate. Can't tell you how as I only use linux for recovery. What is needed is the location of the start of the first partition of sdb (sdb1) as your sdb drive was possibly partitioned as one primary partition. If you partitioned and formated your drive yourself, you should be able to reproduce the location with a second drive like the one you have partly overwritten. If not, ask the manufacturer.

Can I somehow re-invent the boot sector's 512 bytes? .. Can testdisk or gparted help?

You can run Testdisk which should find the backup boot sector. From the information within you can calculate the distance of the boot sector to the FAT and the root directory. Use a hexeditor to follow the trace of your zero-based destruction. Once you hit sectors which are not zeroed anymore you know how far you could have overwritten your drive.

By combining these two pieces of information you can guess if you have zeroed the FAT and the root directory as well.

If you have overwritten your FAT and your root directory then Photorec and others will have a hard time recovering if your drive was defragmented.

Other third party tools might at least be able to reconstruct file names in subdirectories but not the complete data content once it's fragmented and the files are longer than one cluster.

Addendum 25.5.2020 19:34 European Central Time

Use the "p"-key in Testdisk to look into the proposed partitions of testdisk. You might want to run an additional deep search. If your terminal history result of your disk layout corresponds to what you remembered of it, you could use Testdisk to manually reconstruct your layout.

If the "p"-key doesn't work, use either Photorec or another third party software. Testdisk is only suitable for certain light dammage on a disk. It is suitable to repair partition schemes. Photorec is the last resort when every metadata ist lost. Third party software fills the application hole.

Can I use this through testdisk to recontstruct the partions?

I don't know how your disk layout has been before. You know and you have to decide.

But can Linux recreate the correct partition types?

If parted or Gparted fail, Testdisk should be able to do so.

| |
  • Thanks for the response. I've edited the question with new information from testdisk and what I found from a previous fdisk -l done earlier in the day...leaving me mildly hopeful. – caycee May 25 at 2:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.