0

I accidentally overwritten part of my ntfs partition with image of another partition using dd if=diskimg of=/dev/sdaX. I canceled it immediately, but unfortunately about 200MB was already written. I'm copying accessible data now, but some directories (most notably directory containing my desktop and documents) are empty. Is there a way to recover files in those directories that haven't actually been overwritten and are only inaccessible?

  • No; You already overwrote the data. – Ramhound Apr 13 '15 at 15:39
  • Not all of them, some are still intact. Unfortunately most of the data missing is the data I actually need whereas the data that's still intact is mostly old data I don't really need anymore. – user437147 Apr 13 '15 at 15:47
  • You can try Recuva ==> piriform.com/docs/recuva/advanced-usage/… – whs Apr 13 '15 at 15:53
0

I did the exact same screwup as you did, overwriting the boot sector, the partition table, and a large portion of the data partition.

The good news is that I managed to salvage most of it. I didn't know of any tools to do this in linux, which would have been preferable, other than dd + grep, but a friend gave me a tip about this tool. It scans through a harddrive for data resembling files, ignoring conveniences such as a file allocation table, or even a partition table. It then allows you to extract said data either one and one manually, or in bulk automatically once detected.

The bad news is that it's not free software, but I can confirm that it works as advertised.

  • Sadly after reboot I can only see System volume information folder from linux. But I'll try again from windows. – user437147 Apr 13 '15 at 17:13
  • After trying to recover a NTFS-Partition overwritten by a 400MB Linux-image, I tried recovery with testdisk and gpart to no avail. GetDataBack didn't give any results either, but with R-Studio I was able to recover the files (Not the original folder structure though, and a lot of useless files it appears to have made up from the fragments). – Christian Benke Nov 14 '16 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.