Welcome • User Guide
ToS • Privacy • Canary
Donate • Bugs • License

©2024 Poal.co

173

dd (disk dump) is a low-level data streaming tool, upon which gddrescue is based.

Yesterday, when working at the computer while tired, I accidentally mistyped the output drive file when I wanted to restore a damaged MicroSD card (/dev/sdo) file system from an image file. This is the first time this mistake happened to me. Maybe it was bound to.

This caused the file system of the flash drive at /dev/sdp to be crucified (overwritten by the image file intenfed for /dev/sdo). I realized the mistake after around 10 seconds, but the first ~400 MB were already overwritten.

Thankfully, parts of the data were backed up. But I now realize how much I took the now lost data for granted.

And thankfully, the USB 3.0 hub was connected to the computer through an USB 2.0 cable! Otherwise, the much higher transfer rates would have demolished much more data!

Some files still exist, but can only be found using forensic software which scans for file headers.

And some fragmented files will need to be puzzled together. But file names, attributes (e.g. dates and times), and directory paths are completely lost.

`dd` (*disk dump*) is a low-level data streaming tool, upon which `gddrescue` is based. Yesterday, when working at the computer while tired, I accidentally mistyped the output drive file when I wanted to restore a damaged MicroSD card (`/dev/sdo`) file system from an image file. This is the first time this mistake happened to me. Maybe it was bound to. This caused the file system of the flash drive at `/dev/sdp` to be crucified (overwritten by the image file intenfed for `/dev/sdo`). I realized the mistake after around 10 seconds, but the first ~400 MB were already overwritten. Thankfully, parts of the data were backed up. But I now realize how much I took the now lost data for granted. And **thankfully**, the USB 3.0 hub was connected to the computer **through an USB 2.0 cable!** Otherwise, the much higher transfer rates would have demolished **much more data!** Some files still exist, but can only be found using forensic software which scans for file headers. And some fragmented files will need to be puzzled together. But file names, attributes (e.g. dates and times), and directory paths are completely lost.

(post is archived)

You are currently inside a comment thread.
Click here to see all the comments (8).
[–] [deleted] • 1 pt (edited )

what in the fuck are you doing that a machine with an sdcard slot has block devices all the way up to letter fucking p ? O_o

EDIT: hit that bitch with a testdisk run and you will be amazed at what happens:

https://www.cgsecurity.org/wiki/TestDisk

it's the holy grail of data recovery software

[–] • 1 pt

If I disconnect and reconnect a device, the letter goes up by one.

Also, IsoBuster (shareware) and Autopsy/SleuthKit (open-source) are great too.

[–] [deleted] • 1 pt (edited )

Oh that's weird. I don't see that in my linux box. It reuses letters. /shrug

EDIT: testdisk has done incredible things for me at work and home where other software failed. I use it first. Not sure I'll ever need the ones you mentioned.

[–] • 1 pt

Thanks much for the recommendation.

And it is open-source too! Awesome!

[–] • 0 pt

Something that is lacking about testdisk is that it won't recreate directory structure and filenames, at least in the cases I tried it on. Probably that happens because of the file system, but I believe there's a tool for ext4 that can recreate filenames and directories properly.