USB stick recovery after dd with miniroot64.fs

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

USB stick recovery after dd with miniroot64.fs

Mihai Popescu-3
Hello,

I used a storage USB stick to dd the miniroot64.fs on it. It was the
wrong one with some useful files saved on it and I did the dd
if=miniroot64.fs of=/dev/rsd1c bs=1m and let it write. The USB size is
almost 32Gb, it was configured as one msdos partition, sd1i.

Is there any chance to recover even some files from this USB stick?
I read some disaster recipes, but I want to ask for the best one, to
avoid even more damage.

Thank you.

Reply | Threaded
Open this post in threaded view
|

Re: USB stick recovery after dd with miniroot64.fs

Janne Johansson-3
Den tors 3 jan. 2019 kl 17:21 skrev Mihai Popescu <[hidden email]>:
> I used a storage USB stick to dd the miniroot64.fs on it. It was the
> wrong one with some useful files saved on it and I did the dd
> if=miniroot64.fs of=/dev/rsd1c bs=1m and let it write. The USB size is
> almost 32Gb, it was configured as one msdos partition, sd1i.
>
> Is there any chance to recover even some files from this USB stick?
> I read some disaster recipes, but I want to ask for the best one, to
> avoid even more damage.


http://ports.su/sysutils/ddrescue
or
http://ports.su/sysutils/testdisk

perhaps?


--
May the most significant bit of your life be positive.

Reply | Threaded
Open this post in threaded view
|

Re: USB stick recovery after dd with miniroot64.fs

Hiltjo Posthuma
In reply to this post by Mihai Popescu-3
On Thu, Jan 03, 2019 at 06:19:41PM +0200, Mihai Popescu wrote:

> Hello,
>
> I used a storage USB stick to dd the miniroot64.fs on it. It was the
> wrong one with some useful files saved on it and I did the dd
> if=miniroot64.fs of=/dev/rsd1c bs=1m and let it write. The USB size is
> almost 32Gb, it was configured as one msdos partition, sd1i.
>
> Is there any chance to recover even some files from this USB stick?
> I read some disaster recipes, but I want to ask for the best one, to
> avoid even more damage.
>
> Thank you.
>

sysutils/testdisk is very good.

Good luck,

--
Kind regards,
Hiltjo

Reply | Threaded
Open this post in threaded view
|

Re: USB stick recovery after dd with miniroot64.fs

Mihai Popescu-3
In reply to this post by Mihai Popescu-3
> sysutils/testdisk is very good.

No success with that. It looks like all partitioning information has
vanished. I don't know partitioning at bit level so I cannot try more.
If anyone succeded with this kind of overwrite, or if there is any
chance to recover something, please write it here.

Thanks.

Reply | Threaded
Open this post in threaded view
|

Re: USB stick recovery after dd with miniroot64.fs

gwes-2
On 01/04/19 10:04, Mihai Popescu wrote
>> sysutils/testdisk is very good.
> No success with that. It looks like all partitioning information has
> vanished. I don't know partitioning at bit level so I cannot try more.
> If anyone succeded with this kind of overwrite, or if there is any
> chance to recover something, please write it here.

Wiping the first 1mb of almost any file system can completely destroy it.
FAT and (to a great extent) NTFS keep all the vital information
at the beginning.
Unix-derived UFS, FFS, ext2,3,4 file systems spread most of the information
enough to allow recovery of most of the files after such a disaster.

Some triage - sorry but I've lost the beginning of this thread.

Since most sticks are preformatted as FAT32 that's what I'm assuming

The root directory and the information linking the
blocks of each file together are in the first part of the disk.
In the best case a sufficiently smart
program could find the -first- data block of files which were -not- in
the root directory. I don't know of any such program but there may be one.

If the file(s) are not editable text, assume it's impossible in most cases.

If any file on the stick has been modified or deleted since it was new
and any new data written recovery is much harder since data are now
scattered and interposed.
Assume it's impossible unless you have very great need and a lot of time.

If there was only one file on the stick, it was a text file and it was a
new stick, everything but the first 100-500k or so might be recovered by
   ¬†dd if=stick of=recoveredjunk \
         count=<estimated size in 512byte blocks + 1000>
and then editing recoveredjunk

If there were multiple text files, add all their estimated sizes together
If it's all text you *might* be able to reassemble them by editing the file.
                                                                         
Good luck!
geoff steckel