Overwritten XFS

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
0BADC0DE
Posts: 1
Joined: 05 Dec 2018, 16:09

Overwritten XFS

#1 Post by 0BADC0DE »

Hi all.
This is the scenario.

The environment is Linux (Arch Linux actually).
An uncompressed 1,3TB tar file has been written on a freshely XFS-formatted 2TB disk with a single DOS partition eating all the available space as a backup.
Later on, a 586MB UEFI boot image has been written (by mistake) to the very same disk device with this very command: dd if=./bootimage of=/dev/sdd bs=4M.
What I understand is, besides the idiocy of the action, that the disk hasn't been reformatted nor wiped. "Just" its first 586MB worth of sectors have been overwritten (I have the very same file it's been used to overwrite).

I've done a dump (dd) of that disk, have "fixed" the partition table by simply recreating it. fdisk said that it found a XFS signature that I asked to keep.
Unluckily testdisk (7.1-WIP) fails and says that it doesn't support such a file system. This is very likely due to the overwrite as the tool says it has support for XFS.
What could it be a good strategy to make extra tests?
I have a two in mind:

* overwrite again, with all zeros from /dev/zero, the exact same amount of bytes/sectors.
* reformat with mkfs.xfs (but am not sure the formatting won't overwrite other parts).

Any hint?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Overwritten XFS

#2 Post by cgrenier »

It's not a bad idea to wipe the wrong information but be very careful about the size when using dd.
Try xfs_repair. It should be able to use a secondary superblock to repair the primary superblock.

Locked