I've DD'd a drive, lost the files and want to get them back - how would you do it?

Question

I had a 2TB USB drive (LVM2/xfs), and accidentally dd'd an CentOS image (5GB) onto it. I have been trying to recover the data that was on that USB dDrive by creating a (testdisk) ddrecover image that I plan to run photorec on, in order to recover files, using the documentation from cgsecurity.org.

While I am waiting for that to complete, I thought it might be worth talking to the people here and checking to see if anyone has ever done anything similar. Did it work, and are there any other methods the forum would recommend?

I have googled and googled.

Thanks to you all.

Daniel

This link may add some tips, for example to work on a cloned copy. — sudodus, Oct 17 '20 at 14:32
If it data that would be nice to have back, you can try yourself. If it is important data you must have back, would recommend having a professional do it. — crip659, Oct 17 '20 at 14:54
Thanks for the replies, everybody. I've cloned the disk, and am now using photorec to try for file recovery. @user6186, I was using CentOS7 (not Ubuntu). Thanks for the advice, everybody. — user1138706, Oct 21 '20 at 08:25
So, I wanted to add an update, which might help people who do this after me: — user1138706, Oct 28 '20 at 15:16

score 0 · Answer 1 · answered Oct 28 '20 at 15:29

I wanted to give an update on this, with my findings:

creating a disk image does take a long time, but seems to be the safest method of performing this work (photorec can be pointed at the image, instead of the USB drive).
It makes sense to be specific about the kinds of files one wants to recover, instead of selecting all file types: it speeds up the process.
Run the photorec software at the maximum block size, if possible. This is the third run I have performed, and this seems to be a very important discovery. In previous runs, i did not consider block size, so the files that photorec spat out where around 500 blocks.

I am really impressed so far, as the software has found a pdf file from the disk image - it's not all there, but I can get it from source, after completion.

More updates to follow.

I've DD'd a drive, lost the files and want to get them back - how would you do it?

1 Answers1