I accidentally wrote to /dev/sda1, then I did it to /dev/sdb1

Question

My knowledge of Unix systems is patchy at best and when it came down to copying things to a drive I attempted the commands cp ./files.files /dev/sda1. At the time I was copying a tar ball that was in an ext4 partition to a NTFS partition.

It wasn't until I booted onto my Windows OS that I realised that my hard drives have turned into RAW file systems. These were significant drives that had quite a bit of data. I could attempt to recover this data through a recovery tool but I was hoping there was a solution that would fix whatever I did to the partition table(?).

What is /dev/sda1 if it isn't a directory to the drive?

Answer 1

Call a professional data-recovery company. Do not try to fix this yourself. (End of soapbox speech.)

/dev/sda1 is the first partition on your first drive. It starts with the NTFS header and is followed by your Windows C: contents. The header is now gone, and some of your data may be also.

One way to fix it (don't try this yourself!) might be to format an identical drive with the identical version of Windows, then grab the first bytes from that drive up to the size of the file you copied to sda1. No guarantees, though. If files.files is large enough, some of your root directory c:\ will be gone.

In the future, use mount to associate drives in /dev with directories ("mount points"), then access those directories. Good luck!

Answer 2

On Unix everything is a "file" and /dev/sda1 is the "file" that points to the 1^st partition of the 1^st SCSI Disk sda, or the raw partition.

To copy data to the file-system on that partition you should have mounted that partition first, with the mount command.

What you did was write over the first X bytes of that partition, completely ignoring the file-system, which therefore is not immediately recoverable.
Data recovery tools (or service companies) are likely to recover data from the remainder of that partition, if you don't have recent back-ups.

Answer 3

You have written the contents of the file(s) directly to the first partition of the first hard drive on your system. Depending on the size of the file(s) you copied you will have overwritten:

1. The NTFS boot sector. Since you say it was not a boot drive, this is probably no great loss.
2. The Master File Table. This is a list of where to find all the files on the disk, along with various metadata. Very small files are completely included within the MFT.
3. The first few files on the disk. These are permanently lost.

You won't have overwritten the partition table, that lives at the beginning of the disk, outside the partitions. If you had written to /dev/sda (no number) then you would have hit the partition table and master boot record.

To recover your files will be difficult, and making a mistake could damage or overwrite files which are recoverable. It's probably easier to restore from backups - you do have backups, right? Failing that, get a data recovery professional to do it. If you can't do that for whatever reason, make a clone of the drive, and work on the clone. That way, if you make a mistake, you don't destroy the original.

If you are going to try the recovery yourself, you want to get a copy of the MFT. Luckily, on an NTFS system there is at least one backup copy, sometimes referred to as MFT mirror or MFTmirr, somewhere on the partition. If you can find that, then you will be able to copy off the undamaged files.

I have been able to recover a drive in this state (courtesy of a failed windows update) using specialist software. It was a long time ago, and I can't remember what software I used, but it was probably TestDisk. The wiki describes how to restore the MFT from the mirror, and you can get the NTFS boot sector back that way too, if you need it.