3

My knowledge of Unix systems is patchy at best and when it came down to copying things to a drive I attempted the commands cp ./files.files /dev/sda1. At the time I was copying a tar ball that was in an ext4 partition to a NTFS partition.

It wasn't until I booted onto my Windows OS that I realised that my hard drives have turned into RAW file systems. These were significant drives that had quite a bit of data. I could attempt to recover this data through a recovery tool but I was hoping there was a solution that would fix whatever I did to the partition table(?).

What is /dev/sda1 if it isn't a directory to the drive?

migrated from serverfault.com Aug 11 '15 at 17:24

This question came from our site for system and network administrators.

  • In almost all cases, you'd need to have been root to do this. That should have been a warning. :( – ChrisInEdmonton Aug 11 '15 at 17:30
10

Call a professional data-recovery company. Do not try to fix this yourself. (End of soapbox speech.)

/dev/sda1 is the first partition on your first drive. It starts with the NTFS header and is followed by your Windows C: contents. The header is now gone, and some of your data may be also.

One way to fix it (don't try this yourself!) might be to format an identical drive with the identical version of Windows, then grab the first bytes from that drive up to the size of the file you copied to sda1. No guarantees, though. If files.files is large enough, some of your root directory c:\ will be gone.

In the future, use mount to associate drives in /dev with directories ("mount points"), then access those directories. Good luck!

  • Thanks for the prompt response! They're purely storage drives, no OS on them or bootloaders(?). I know the size of the file I copied, but does the header contain how to put together defragmented information? Would data recovery software be able to put together? – Wholemeal Aug 11 '15 at 10:13
  • 4
    No, they are the real drives as you would see them in Windows. If you've installed an OS, it's there. I politely decline to answer your other question because you should not try to fix this yourself. Seriously. For real. Not kidding. Sorry to be the bearer of bad news! – cxw Aug 11 '15 at 10:31
10

On Unix everything is a "file" and /dev/sda1 is the "file" that points to the 1st partition of the 1st SCSI Disk sda, or the raw partition.

To copy data to the file-system on that partition you should have mounted that partition first, with the mount command.

What you did was write over the first X bytes of that partition, completely ignoring the file-system, which therefore is not immediately recoverable.
Data recovery tools (or service companies) are likely to recover data from the remainder of that partition, if you don't have recent back-ups.

8

You have written the contents of the file(s) directly to the first partition of the first hard drive on your system. Depending on the size of the file(s) you copied you will have overwritten:

  1. The NTFS boot sector. Since you say it was not a boot drive, this is probably no great loss.
  2. The Master File Table. This is a list of where to find all the files on the disk, along with various metadata. Very small files are completely included within the MFT.
  3. The first few files on the disk. These are permanently lost.

You won't have overwritten the partition table, that lives at the beginning of the disk, outside the partitions. If you had written to /dev/sda (no number) then you would have hit the partition table and master boot record.

To recover your files will be difficult, and making a mistake could damage or overwrite files which are recoverable. It's probably easier to restore from backups - you do have backups, right? Failing that, get a data recovery professional to do it. If you can't do that for whatever reason, make a clone of the drive, and work on the clone. That way, if you make a mistake, you don't destroy the original.

If you are going to try the recovery yourself, you want to get a copy of the MFT. Luckily, on an NTFS system there is at least one backup copy, sometimes referred to as MFT mirror or MFTmirr, somewhere on the partition. If you can find that, then you will be able to copy off the undamaged files.

I have been able to recover a drive in this state (courtesy of a failed windows update) using specialist software. It was a long time ago, and I can't remember what software I used, but it was probably TestDisk. The wiki describes how to restore the MFT from the mirror, and you can get the NTFS boot sector back that way too, if you need it.

  • 1
    +1 There is nothing wrong in trying to fix it yourself. Just be sure to create a sector-by-sector backup of the damaged drive/partition before trying. You'll most likely screw up on the first tries and make it even worse - you'll need the backup to start over again then. – s1lv3r Aug 11 '15 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy