up vote 1 down vote favorite
2

So I created a linux live cd with the dd command. On the wrong usb drive. My 1TB drive now has a 500MB live usb installation on it. I have ~500GB of files that I'd quite like back.

Is there any hope of recovery and if so what is the best method?

The filesystem was ntfs, now obviously it's an iso.

full command used:

sudo dd if=/path/to/iso of=/dev/sdX bs=4M;sync
share|improve this question
up vote 6 down vote accepted

You can try using TestDisk to recover the partition, but unfourtunately, using DD is about the easiest way to destroy a disk (thats why its called DD) irrevocably, since it overwrites existing data.

you can find TestDisk, and PhotoRec on a number of system rescue disks. I've used this one before: http://www.ubuntu-rescue-remix.org/

TestDisk recovers partitions all in one peice, so hopefully it will be able to find and recover the partition for you.

PhotoRec is what you use when TestDisk fails. it searches the harddisk for unfragmented binary files with known headers and footers, to recover known file types like .mp3, .jpg etc. since your drive was only partially overwritten (I assume your ISO is nowhere near 500GB) you should be able to recover everything that wasn't overwritten as long as its a type Photorec can recognize.

Heres some great general info on Data recovery on linux: https://help.ubuntu.com/community/DataRecovery

share|improve this answer
up vote 1 down vote

When your data is overwritten, as opposed to "only" deleted, I'm afraid your data is permanently gone. Your only chance is to deliver your HDD to a professional data recovery company, that may be able to reconstruct some of it. This is usually really expensive, however, so you'll have to consider how important those data are/were to you.

share|improve this answer
1  
Even those recovery services are limited in what they can do. If the data has been overwritten the data is gone. Those recovery services are only really useful when the hdd is not recongized or there is some physical defect causing the problems. – Ramhound Dec 4 '12 at 13:05
    
I'm confused - as I see it, dd wrote 500MB of files to the hdd. Surely not all of the previous file system's 500GB has been overwritten? – user1561108 Dec 4 '12 at 13:26
3  
true, but without the Partition and File system tables ($MFT) the files are just a pile of data and its very hard to tell where one blob of data ends and another begins. also filenames, extensions, and folder location are stored in the $MFT so an attempt to recover files without a good index will recover files without meaningfull names and without folders. any files without a known header/footer or text encoded documents will all come back as .txt. you are right, most of your data was not destroyed, but it may as well be inaccessible. hopefully most of your files can be found by photorec. – Frank Thomas Dec 4 '12 at 13:42
1  
@user1561108 Good explanations of Ramhound and FrankThomas. Photorec is worth a try for those files not wholly overwritten by the ISO. – poplitea Dec 4 '12 at 13:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.