recovery recommendations

Eric Sandeen sandeen at
Fri Jan 21 19:06:05 UTC 2011

On 1/21/11 12:36 PM, m.p. wrote:
> Recently a 640GB external enclosure was PEBKAC'd with the following
> command:
> dd if=/some-185mb-linux-install.iso of=/dev/sdx
> [not of=/dev/sdx1]
> Since the PEBKAC, the drive has not been written to beyond being
> unplugged. I have made an image of the drive and have attempted to run
> against it: testdisk, fsck.ext3 with alternate superblocks, and even
> "fsck.ext3 -Sy", to no avail.
> So. I am *convinced* that my 550gb of data is recoverable. It seems that
> [obviously] the first 185mb is gone - whatever files those were.

You really need to restore from backups.  You just overwrote 30% of
your filesystem with something else... you've lost partition data,
metadata, directory data, file data ... whatever was in that first

I think the best you can do is low-level recovery at this point,
groveling around for file fragments with something like the photo recovery

> I have googled, but to be honest, I am not entirely sure I'm searching
> the right strings. Most software seems geared towards partition recovery
> where a partition has become damaged [which is technically what's
> happened], 

You've done much more than that...

> but not exactly; or partition undeleting [which again isn't
> technically what happened].
> Please, any recommendations that don't involve a time machine are much
> appreciated.

Maybe, just -maybe- if you can find a backup superblock, fsck might try
to piece a few things together.

But you can't generally overwrite 1/3 of a filesystem and expect normal
tools to recover for you, I'm afraid.


> If this isn't the place to be asking, please point me in the right
> direction.
> Thank you.
> -mp- - kicking self -
> _______________________________________________
> Ext3-users mailing list
> Ext3-users at

More information about the Ext3-users mailing list