Overwritten Partition Tables with dd

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
hkjz
Posts: 2
Joined: 28 Mar 2020, 16:16

Overwritten Partition Tables with dd

#1 Post by hkjz »

Hello,

==================================================
1)
i have had an external hard drive 2TB,
while it was plugged in and something was being copied from/to, i plugged in USBstick to install linux on it.

I selected wrong target USB Device, and 'dd' process started. I canceled it after couple seconds, but problem arrived unavoidable.

It was partition with Apple OSx backups, so it probably was sort of modern Apple PartitionTables


==================================================
2)
Current status of the drive is like this

Code: Select all

Disk /dev/sda: 1.8 TiB, 2000398934016 bytes, 3907029168 sectors
Disk model: M3 Portable     
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x814555ba

Device     Boot Start      End  Sectors  Size Id Type
/dev/sda1        8192    92159    83968   41M  c W95 FAT32 (LBA)
/dev/sda2       92160 15126527 15034368  7.2G 83 Linux
==================================================
3)
I've got other 2TB drive, and made 'dd' copy of the overwritten one, to work saftely.

==================================================
4)
current software i have is
TestDisk 7.0
PhotoRec 7.0

thank you,
your work is and will be appriciated.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Overwritten Partition Tables with dd

#2 Post by cgrenier »

It's probably an EFI GPT partition table.
Here is an example of an encrypted 3TB external disk seen by latest 7.2-WIP

Code: Select all

     Partition			Start        End    Size in sectors
 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Apple Core Storage        409640 5860270983 5859861344
 3 P Mac Boot              5860270984 5860533127     262144 [Booter]
You can run PhotoRec a few minutes and see if it recover something (ignore the files copied by dd). If it recovers your data, it's not an encrypted filesystem.

hkjz
Posts: 2
Joined: 28 Mar 2020, 16:16

Re: Overwritten Partition Tables with dd

#3 Post by hkjz »

@cgrenier,
thank you,

Encryption was never a topic on this hard drive, it is not encrypted,

It was one partition backup harddrive, where i overwritten Partition Tables (as it is shown in sudo fdisk -l above), and files are not visible anymore.

===========================================================
Which approach would be preferable way, to handle such a situation.
Am i able to get partition back, folders names, file names
or best i can count on,
is recovery made by PhotoRec with 'random' names like f234567887654.png ?

Locked