cgsecurity.org

I have done a stupid thing

dd bs=2048 if=/dev/zero of=/dev/sdb count=1024

Now, the drive had only one partition for the whole drive and it was formated as ext4

While the system was still running I did this:

hdparm -g /dev/sdb
/dev/sdb:
geometry = 243200/255/63, sectors = 3907012784, start = 0
-----------
hdparm -g /dev/sdb1
/dev/sdb1:
geometry = 243199/255/63, sectors = 3907007937, start = 63

when I run testdisk the regular search does not find anything, but the deep search shows the partition almost instantaneouly .
I did not wait till the end of the deep search and stopped it. (it will be several hours before it will finish)

I am asking if there is hope to recover the partition with data on it.
Since some of the information is available about the partition maybe something can be done to recover it

Thank you very much for your help

Lazar

Hi,

I did the same mistake as you...

Did you manage to recover your data?

Thanks,

The dd command hasn't overwritten the whole disk "only" the beginning. It's why TestDisk can locate NTFS backup boot sector or ext2/3/4 backup superblock after the zone that have been overwritten.
As written previously, use TestDisk, Analyse, Quick Search, Deeper Search to locate your partitions.