0

so I'm studying cybersecurity and I'm currently working with bitlocker security, and on one of my tests, I tried to copy a whole windows nvme disk using a live Ubuntu stick and DD (note that the drive is encrypted with bitlocker). Unfortunately, I swapped the two disks, so I did:

sudo dd if='external_disk' of=/dev/nvme1 conv=noerror, sync

Instead, I should do:

sudo dd if=/dev/nvme1 of=/dev/'external_disk' conv=noerror, sync

So I tried to write the data back using TestDisk, but nothing worked; no data was written. I also tried Photorec, but the files that were recovered were old files from the external disk.

ABDULLOKH MUKHAMMADJONOV
  • 109
dacomet
  • 1
  • 6
    You overwrote all the data on your Windows partition with the data from the external disk. This is also why you can only recover old files from your external disk from the Windows partition now. To me it looks like unfortunately, all data on your Windows partition is lost and you cannot recover it, as you have already overwritten all the data. – Malte Skoruppa Apr 03 '22 at 18:54
  • 3
    As above. This is why dd got its "disk destroyer" moniker, once started with the wrong instructions it's game over. – ChanganAuto Apr 03 '22 at 20:48
  • Grab out your backups & restore... You've provided no size data, but if the NVME was larger than the external_disk; you may find that part of your data was not overwritten by external_disk data. – guiverc Apr 03 '22 at 22:38

0 Answers0