Recover external hard drive after dd command

dataexternal-diskrecovery

I'm trying to be calm… and will try to explain this as best I can.

I was trying to use the dd command to burn an iso image to a 16GB MicroSD for my RaspberryPi. I had my 2TB USB hard drive also connected on the other USB-C slot and by accident, I completely wrote over the 2TB drive of important files instead of the 16GB MicroSD!

The command I executed was:

sudo dd bs=4m if=PlexMediaPlayer-1.3.4.699-1d4f6da1.RPi2-arm.img of=/dev/disk2

Where /dev/disk2 was the 2TB external USB drive. The output of the command was:

137+0 records in

137+0 records out

574619648 bytes transferred in 19.313496 secs (29752234 bytes/sec)

The drive now has the contents of what was originally in the .img file intended for the 16GB MicroSD. Everything else is gone from the 2TB external USB Drive.

My whole life is in that 2TB hard drive, including the photos of my kids since they were small, etc. I can't imagine what else was lying in that drive.

I'd really appreciate any help anyone can provide. 🙁

Best Answer

First step: create a bit for bit copy of the destroyed drive using the dreaded dd command which took down your drive in the first place. Make sure you disable Time Machine and any other background application which wants to write on your disk (Spotlight aka mds is another one).

Second step: start trying to pull data off the copy (don't use the original except as read only until you've recovered your data).

I used to use Prosoft's Data Rescue 2 & 3 but the new version requires an internet connection (for no good reason). I can't recommend it on principle. Cleverfiles's Disk Drill at least lets you preview your data before you pay. You could try Lazesoft Mac Data Recovery which is donationware. If Lazesoft gets your files back, you should donate (generous programmers deserve to be rewarded). Some of flash drive manufacturers included file recovery utilities, SanDisk RescuePro program has worked for me but maintaining a licensed copy is such a hassle I don't think I have one now.

If the first data recovery program fails you, you can try some others. Even if the data recovery programs destroy your backup, you can always do another bit to bit clone to try with other programs.

Single step version:

I've just noticed that even free Disk Drill includes a workflow with built-in byte-to-byte copy to DMG routine which would be easier to implement and get you off the command line right now.

Just proceed with "Backup / Backup into DMG-image". The unique aspect of the byte-to-byte backups is the fact they actually store the contents of data sectors that were marked as empty, not occupied by data. Yes, you get it right, the sectors where your lost data can still reside. Once the backup disk image is created, you may start your hard drive recovery from the image instead of the real hardware. This will ensure the final failure will not occur while Deep Scanning, more data stays safe and potentially recoverable.

As others pointed out, keeping backups is really, really important as everyone makes mistakes and bits fry every once in a while.

Good luck getting your important personal archives and photos back!

Related Question