Help with a little dd damage!

[Jacques B.]

On Wed, Feb 27, 2008 at 6:56 AM, Ian Malone <ibmalone at gmail.com> wrote:
> Brian Chadwick wrote:
>
> > Morgan Read wrote:
>
>  >> [root at morgansmachine DiskBUImagesEtc]# dd if=/dev/sda
>  >> of=2ndstage.rescue bs=1K count=1280
>  >> 1280+0 records in
>  >> 1280+0 records out
>  >> 1310720 bytes (1.3 MB) copied, 0.0535238 s, 24.5 MB/s
>  >> [root at morgansmachine DiskBUImagesEtc]# chown morgan: ./2ndstage.rescue
>  >> [root at morgansmachine DiskBUImagesEtc]# dd if=zImage-LAB-20060421.htc
>  >> of=/dev/sda
>  >> 2348+0 records in
>  >> 2348+0 records out
>  >> 1202176 bytes (1.2 MB) copied, 0.117155 s, 10.3 MB/s
>  >> [root at morgansmachine DiskBUImagesEtc]#
>  >>
>
>
> >> So, fingers firmly crossed, have I managed to copy enough of my hard
>  >> drive with the first two commands to be able to patch back the
>  >> catastrophic damage I seem to have done with the last command.  Could
>  >> someone more confident than I give me some instruction:)
>
>
> > sorry ... dd is final ... it did what you said as a root user. dont you
>  > love linux ... it does EXACTLY what you say when you are root.
>  >
>
>  The point was Morgan has an accidental sort-of backup of the bit
>  he dd-ed over.
>
>  --
>  imalone
>
>
Good catch Ian. I had not paid attention to that fact.  You have the
first 1.3 megs of /dev/sda backed up to 2ndstage.rescue. So you could
reverse your dd command as follows
dd if=./2ndstage.rescue of=/dev/sda
and that would replace the start of /dev/sda back with what was
originally there before you overwrote it (because thankfully you
backed it up before overwriting it).

The one caveat is if the data at that location that has since changed
from current activities on your box then restoring that data back to
its previous state could cause problems.  I did an md5sum of that
block on my system and then created & removed an empty file on /boot
(the first partition on the device) and re-hashed with no change so
the data did not change in those first 1280K as a result of creating a
file on the first partition of that device.  It was a pretty basic
test but hopefully a reflection of your situation.

You have your critical data backed up.  At this point I'd risk
reversing the dd command to replace those first 1280K with the
original data that you backed up to ./2ndstage.rescue.

Jacques B.