Hi all.
This is the scenario.
The environment is Linux (Arch Linux actually).
An uncompressed 1,3TB tar file has been written on a freshely XFS-formatted 2TB disk with a single DOS partition eating all the available space as a backup.
Later on, a 586MB UEFI boot image has been written (by mistake) to the very same disk device with this very command: dd if=./bootimage of=/dev/sdd bs=4M.
What I understand is, besides the idiocy of the action, that the disk hasn't been reformatted nor wiped. "Just" its first 586MB worth of sectors have been overwritten (I have the very same file it's been used to overwrite).
I've done a dump (dd) of that disk, have "fixed" the partition table by simply recreating it. fdisk said that it found a XFS signature that I asked to keep.
Unluckily testdisk (7.1-WIP) fails and says that it doesn't support such a file system. This is very likely due to the overwrite as the tool says it has support for XFS.
What could it be a good strategy to make extra tests?
I have a two in mind:
* overwrite again, with all zeros from /dev/zero, the exact same amount of bytes/sectors.
* reformat with mkfs.xfs (but am not sure the formatting won't overwrite other parts).
Any hint?
Overwritten XFS
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
- cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Overwritten XFS
It's not a bad idea to wipe the wrong information but be very careful about the size when using dd.
Try xfs_repair. It should be able to use a secondary superblock to repair the primary superblock.
Try xfs_repair. It should be able to use a secondary superblock to repair the primary superblock.