I wanted to install opensuse alongside my trusty setup. When doing:
dd if=/path/to/downloaded.iso of=/dev/sdX bs=4M
I selected the iso to lay onto the harddrive instead of the flash drive and all of my data is gone. Can I recover the operating system? Can I at least recover my 30 gigs of vinyl recordings?
Best Answer
dd
is a whole lot worse thanrm
or any other mechanism that just marks blocks in the filesystem as available.dd
does verbatim reads and writes on the disk or partition, thus by overwriting it not only deletes files on the filesystem but destroys information on the filesystem how the data was organized and the filesystem itself. While some data structures like EXT superblocks have some redundancy this does not allow to recover overwritten data.Dependent on the behavior of
dd
, that is if it filled the remaining space of the partition with zeros and was let to finish the task, consider all data on the partition lost.There is this myth that you still have to overwrite data several times to make data recovery almost impossible. The recovery techniques this is based upon are not applicable to modern disks and Peter Gutmann is cited in one of the answers with:
More over the typical suggestion to make a raw copy of the disk and use the copy for recovery attempts is misleading. With failed drives that may be a possible solution, but also puts a lot of stress on the drive which may be counter productive. In your
dd
-scenario though this is different and looks like a quite moronic approach. Recovering data that was overwritten withdd
by creating a copy withdd
for further recovery approaches? That shouldn't give you anything else than whatdd
previously wrote, right? Now of course if you want to prove that Peter Gutmann's or more advanced methods still work with newer drives, you only want to read from the source drive and don't write to the drive to prevent further overwriting of data.Honestly, trying to recover all data will be almost impossible, waste a lot of time and bind resources (the drive cannot be used and the computer must continue the recovery process) that you could have easily avoided by creating backups and being more careful with such dangerous commands.