Can the contents of a partition be recovered after partition table is overwritten

bootable-diskexternal-diskpartitionterminal

I ran a command to make my external hdd bootable knowing that it was risky considering the command itself did not allow me to specify a partition to which to write. (In hindsight, I would now call this a stupid decision – but at the time, I tried this command:)

$ sudo dd if=/Users/MyUser/Downloads/Fedora-17-x86_64-Live-Desktop.iso \
> of=/dev/disk1 bs=1m

For which the output I received was:

645+0 records in
645+0 records out
676331520 bytes transferred in 98.578444 secs (6860846 bytes/sec)

I knew right away that it was fishy since /dev/disk1 was split into three partitions, all of which were hfs. Since it's next to impossible to find good information on making a bootable partition from an external USB device, I tried this in spite of the risks.

I did no further writing to my external HDD after this point, since now the only partition I see when I mount the drive is 'Fedora 17.'

What is the likelihood of recovering the files I had stored in my Backup partition? And how should I have done this in the first place?

NOTE: This is how my partitions were before I tried dd.

$ diskutil list
/dev/disk0
#:                       TYPE NAME                    SIZE       IDENTIFIER
0:      GUID_partition_scheme                        *160.0 GB   disk0
1:                        EFI                         209.7 MB   disk0s1
2:                  Apple_HFS Macintosh HD            159.7 GB   disk0s2
/dev/disk1
#:                       TYPE NAME                    SIZE       IDENTIFIER
0:      GUID_partition_scheme                        *1.0 TB     disk1
1:                        EFI                         209.7 MB   disk1s1
2:                  Apple_HFS Linux                   50.0 GB    disk1s2
3:                  Apple_HFS Backup                  500.0 GB   disk1s3
4:                  Apple_HFS Misc                    449.6 GB   disk1s4

Best Answer

Quick and Simple: Since it's a GPT disk you can run gpart recover /dev/disk1 to fix the table. You blew away the first ~700MB of the drive, so any partitions touching that area are gone too (more or less). The rest of the disk should be fine. I'm not sure if OSX comes with gpart, so you may need to download it somewhere.

The longer details: Concerning the partition(s) that were only partially overwritten, some of the files may be recoverable. The tools to do so are much more complicated and you'll be wanting to find someone who really knows what they're doing for this. If you're concerned with any of these files don't even try anything except unplugging the drive. Also, the overwritten data can probably be recovered by a data recovery service, but this would cost tens of thousands of dollars.

Also, if this was a MBR disk you'd be completely hosed unless you happen to know the exact size and offsets of all partitions. This information can be printed from fdisk, but it's best to simply not make mistakes like this.

Related Question