Most Unfortunate Way to Lose Entire PC

Question

I have a PC with Win 7 on it. I install Ubuntu via USB boot.

Side by side installation, with that slider box to partition the hard drive too.

All goes well. Boot to desktop successfully. I try to access the windows partition and an error message appears. Expected.

Then I use an Ubuntu terminal to gzip an img.gz file, to unpack it. Was about 4 Gigs of data.

IICR, I used sudo dd of=/dev/sda

I exited the terminal and shut down Ubuntu. But it appeared to hang at an empty screen (with bg wallpaper), so I held the on/off button to power off right away.

Then I restarted the PC, no Grub, only a blinking underscore on a black screen.

So I powered off and tried to use Boot Repair from my original USB boot. Didn't work. Instructions given to me were too confusing so I quit.

This was on the " 'Try Ubuntu' from USB". I decided to reinstall Ubuntu by clicking on the shortcut on the Desktop.

Window pops up, everything's fine. Then it says that there's already Debian (wheezy/sid) on it. Ehhh?? I had only installed Ubuntu, not Debian.

No mention of Windows too.

Never mind, I did another side by side installation. This time nothing about partitioning popped up.

So now everything's fine, Grub's working fine.

But then I can't find the Windows partition, panic sets in.

A quick check reveals that Debian occupies a tiny portion, while Ubuntu occupies more than 95% of the hard drive space and its largely empty. EMPTY. Oh no.

I remove the hard drive from the PC and plug it to another Windows PC via USB. Shows up as a "Removable Disk" but when clicked Windows asks me to insert a disk into it. Shows up as an empty disk basically.

However, the Ubuntu's still on it, when I boot from it both Grub and Ubuntu run fine.

What should I do next? I might be able to recover some Windows files.

Hope you enjoyed this sad story.

I'm most probably an idiot, but you gotta agree, that's one of the most unfortunate ways to lose an entire PC.

Answer 1

If what you're describing is accurate, your Windows install is completely gone, as is anything in the first four GB of your hard drive and your partition table.

That said, you may still be lucky enough to recover some files (anything after the 4GB mark) through the use of specialized recovery tools. If you want to try this, do not use your hard drive! Follow these instructions, as sourced from this answer:

1. Boot into your live USB and install the testdisk package.
2. Run TestDisk on your hard drive (likely /dev/sda) and be patient while it runs. If it recovers any files, be sure to save them to an external drive quickly. Once again, do not use your original drive.
3. Grab a coffee while TestDisk does its thing.

If TestDisk doesn't work for some reason, you can try using an alternate tool known as photorec, which may have better/different luck. Note that photorec was intended for use with pictures, but it definitely can recover other file types. With either recovery method, your chances of success are decent, though not everything is recoverable anymore. For example, your system may have lost records on filenames and similar. At the very least, this could prevent a catastrophic loss.

I'd highly recommend parsing through any recovered data with the file command line utility, as well as other "discovery" tools to determine what the file contents were. Recovering from these incidents is not easy, even for professional data forensics teams.

After you've recovered everything you can, you should look at formatting your hard drive and starting clean. Install Windows first if you want to keep using it.

As for why your system was reporting a Debian install. I'm guessing your image was a Debian install, and you accidentally dd'd it over your main hard drive. As you can probably guess now, dd is a very dangerous weapon, and you need to be 100% sure you're running exactly the right commands when using it. This would also be the reason why your hard drive's first four GB are nuked -- the Debian image you extracted to it overwrote everything.

In the future to avoid incidents like this, be sure to have (recent and verified working) backups, and take extreme care while partitioning and using the dd command. Both operations have an extreme chance of causing lots of damage, so you need to be 100% sure you're doing exactly what you intend.

---

And just for the sake of completeness and education, here's a representation of what happened:

1. Initial state, Windows installed.
   Your system before doing anything at all.
2. Post-Ubuntu Install.
   At this point, Windows + Ubuntu worked fine with a bit of tweaking.
3. After dd (real) This is the point where everything goes south. The image you wrote to /dev/sda has overwritten your partition data, the EFI boot partition (possibly?), and most importantly, your partition table. Note how your Windows partition has "shrank" from the left. Any data in that shrunk portion is unrecoverable. You'd be able to recover anything in the old NTFS footprint (the selected partition).
4. After dd (according to partition table)
   This is how your hard drive looks like to your partition table. It is not an accurate representation of your hard drive anymore.

Of course, this is not an accurate model because I just made it with gparted using a sacrificial flash drive to try to explain the point. As such, it's really the concept here that matters. Your system may have been different (especially with partition sizes).