Overwritten XFS
Posted: 05 Dec 2018, 16:22
Hi all.
This is the scenario.
The environment is Linux (Arch Linux actually).
An uncompressed 1,3TB tar file has been written on a freshely XFS-formatted 2TB disk with a single DOS partition eating all the available space as a backup.
Later on, a 586MB UEFI boot image has been written (by mistake) to the very same disk device with this very command: dd if=./bootimage of=/dev/sdd bs=4M.
What I understand is, besides the idiocy of the action, that the disk hasn't been reformatted nor wiped. "Just" its first 586MB worth of sectors have been overwritten (I have the very same file it's been used to overwrite).
I've done a dump (dd) of that disk, have "fixed" the partition table by simply recreating it. fdisk said that it found a XFS signature that I asked to keep.
Unluckily testdisk (7.1-WIP) fails and says that it doesn't support such a file system. This is very likely due to the overwrite as the tool says it has support for XFS.
What could it be a good strategy to make extra tests?
I have a two in mind:
* overwrite again, with all zeros from /dev/zero, the exact same amount of bytes/sectors.
* reformat with mkfs.xfs (but am not sure the formatting won't overwrite other parts).
Any hint?
This is the scenario.
The environment is Linux (Arch Linux actually).
An uncompressed 1,3TB tar file has been written on a freshely XFS-formatted 2TB disk with a single DOS partition eating all the available space as a backup.
Later on, a 586MB UEFI boot image has been written (by mistake) to the very same disk device with this very command: dd if=./bootimage of=/dev/sdd bs=4M.
What I understand is, besides the idiocy of the action, that the disk hasn't been reformatted nor wiped. "Just" its first 586MB worth of sectors have been overwritten (I have the very same file it's been used to overwrite).
I've done a dump (dd) of that disk, have "fixed" the partition table by simply recreating it. fdisk said that it found a XFS signature that I asked to keep.
Unluckily testdisk (7.1-WIP) fails and says that it doesn't support such a file system. This is very likely due to the overwrite as the tool says it has support for XFS.
What could it be a good strategy to make extra tests?
I have a two in mind:
* overwrite again, with all zeros from /dev/zero, the exact same amount of bytes/sectors.
* reformat with mkfs.xfs (but am not sure the formatting won't overwrite other parts).
Any hint?