Member Avatar for DeanMSands3

So... this happened at a LAN party. A friend was pestering me for Linux Mint. For some reason YUMI wouldn't recognize my flash drive, so I did it the manual way.

sudo dd if=./linuxmint-17.1-cinnamon-64bit.iso of=/dev/sdb bs=1M

However, it should have been:

sudo dd if=./linuxmint-17.1-cinnamon-64bit.iso of=/dev/sdd bs=1M

It's an ADD/mental auto-pilot sort of thing.

So... the first 1.4G of my 1TB Windows 8.1 drive has been written over with a Linux Mint installer. Before, there was a 100M recovery partition and then the rest was the OS Partition. But now there's only 1 partition: the bloody installer.

I'm fairly certain it's fubar'ed beyond hope with the exception of raw sector reads. I was wondering if any of you had any thoughts or advice on more efficient methods of data recovery before I get started on that.

  • 5 Contributors
  • 5 Replies
  • 236 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by rubberman
Member Avatar for Reverend Jim

Try testdisk. It's free and open source. I haven't had the occasion to try it out but I've read good things about it. There is a step by step here.

Edited by Reverend Jim
Member Avatar for gerbil

sudo dd if=./linuxmint-17.1-cinnamon-64bit.iso of=/dev/sdd bs=1M

You copied a file (image) to a device, not a partition - everything under the iso is hosed, the partition table has been rewritten. Why do they nick dd the data destroyer? beats me...
Anyway.... Linux conforms to the ntfs spec, so the backup table will be overwritten, also. What will remain are the old sector boundaries that have not actually been overwritten (by your iso or other) for all old partitions - TestDisk can find those using its sector search (Deeper Search).
You must recognise the valid from all that it finds, and write them to the table. Of course, the new partition sector will be the first valid one. Your searches can be quicker if all your partitions were written to cylinder boundaries (XP spec); if not necessarily so (Vista, W7 spec), then the search is quite slow.
Each boundary sector (there are beginning and end sectors) contains a table with beginning and end info for that partition, and the MFT location. You need those MFTs - without them, files are simply lost. Testdisk can read file tables, but not rebuild them. So if you choose an incorrect boundary then TD will likely not find that partition's FT (you test by checking file lists, contents).
When satisfied, you write the table. Not correct? Nothing more is lost, but time - you do it all again.
As for your OS, 1.4GB is a lot to lose; there is an excellent possibility that your FT is under that. That's a reload, right there. Any other partitions will be around, though, with all their data. Good luck.

Edited by gerbil
Member Avatar for mike_2000_17

I agree with the others that with a bit of effort and some good recovery tool, you can probably get back nearly all the data off of your drive. Because you only overwrote 1.4GB, it probably didn't touch much, except for some OS stuff. So, that means that probably all your personal data files will be recoverable, but the OS (Windows) will almost certainly have to be reinstalled, as far as I know.

Why do they nick dd the data destroyer? beats me...

Yeah... the dd command is the Linux command that strikes the most fear in me. Every time I use it, I check, cross-check and check again, then take a minute to breath, make sure I want to do what I'm about to do, and then, I check one last time, and then hit the enter key.

Member Avatar for DeanMSands3

Thanks, guys. I'll try it out.

Member Avatar for rubberman

dd is a great tool, but as with all great tools, its proper use requires great responsibility! All the other posts are right on - Rev. Jim, Gerbil, and Mike2k. I use dd to create bit-image backups of my system on a regular basis, and only use it to copy back if something has seriously munged my system image. I keep data backed up via rsync so if I do have to restore the system image, my data is reasonably recent. What you did blew away your Windows 8.1 system drive and file system, but as noted, there are tools that can help you recover your data, considering that the first part of the disc would be system files from when the OS was first installed.

Good luck, and let us know how your recovery process goes.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.