Recover external drive from dd

General system Newbie
21

Yes it would be worth taking an image of the drive as a backup before attempting any data rescue so you have another copy.

22

Im already taking image of the drive. It would take lot of time as i mentioned the drive was full (4T). i will post results when finish.

@ricklinux i havenā€™t used any tool on the drive. iā€™m using testdisk as we speak.

23

Does test disc create a clone or image of the current drive?

24

Screenshot_2022-05-10_16-55-44

making image.dd of the current drive.

25

Take the drive to a data recovery expert and stop messing around with it.

4 Likes
26

Yes thatā€™s the one.

Edit: If the data is that important i agree with @jonathon it would be worth taking it to a recovery expert. Me i never save anything so i donā€™t have this problem. :laughing:

Edit: Case in point i have a few 4 TB drives and they are not even being used in the computer.

Edit: See itā€™s empty!

Screenshot_20220510_100259

27

This is not possible as iā€™m in the middle of Atlantic Ocean. My next port will be in 2 weeks.

28

Thatā€™s a deep dive. :shark:

1 Like
29

@Ozaki
yes as the ISO size is a bit less than 2GB it will only ā€œeraseā€ the first 2GB of the drive ā€¦ but recovering
files can take a long time and you will in most cases lose filenames completelyā€¦
Some professional recovery service can may do magic with specialized tools and knowledge.

Windows tools will not help there much more.

And if you start playing with recovery tools first thing must do is create an image of the drive and use this to recover the filesā€¦

And indeed not to try to use ā€¦ dd to create the image again with of=wrong-drive ā€¦ better use path/to/img

3 Likes
30

Some dim-witted person (myself, I suppose) accidently deleted the better portion of 650 GB of data including text files, photos, mp3s, mp4s, avis, etc. a few weeks ago.

I successfully recovered them all using PhotoRec, plus some long-ago deleted data in sectors that werenā€™t in use any longer. So I learned 3 things that day.

1 Like
31

There is a couple of rules for recovering.

  1. Shut down computer
  2. Remove disk
  3. Boot computer
  4. su -l root
  5. Create a raw image of the device using dd, dc3dd or dcfldd

Mount the image readonly on a loop device - quick guide to forencis imaging of a device

2 Likes
32

Ok guys first of all thanks for all the replies.

Well i used photorec but i had 2 problems.

  1. mostly personal problem is that using photorec the files will be recovered with random titles.
  2. to recover the files from photorec i needed 4T of empty storage to copy the files inside so i didnt proceed.

I just used EASUS Data recovery on a win10 laptop and i can recover the hard drive as it was ( folders names etc. ).

I believe i was lucky that i only ā€œoverwrite on the driveā€ using dd command and did not format it or something similar.

2 Likes