Ubuntu – I accidentally deleted all the data with `dd`. Any chance of recovery


I wanted to install opensuse alongside my trusty setup. When doing:

dd if=/path/to/downloaded.iso of=/dev/sdX bs=4M        

I selected the iso to lay onto the harddrive instead of the flash drive and all of my data is gone. Can I recover the operating system? Can I at least recover my 30 gigs of vinyl recordings?

Best Answer

dd is a whole lot worse than rm or any other mechanism that just marks blocks in the filesystem as available. dd does verbatim reads and writes on the disk or partition, thus by overwriting it not only deletes files on the filesystem but destroys information on the filesystem how the data was organized and the filesystem itself. While some data structures like EXT superblocks have some redundancy this does not allow to recover overwritten data.

Dependent on the behavior of dd, that is if it filled the remaining space of the partition with zeros and was let to finish the task, consider all data on the partition lost.

There is this myth that you still have to overwrite data several times to make data recovery almost impossible. The recovery techniques this is based upon are not applicable to modern disks and Peter Gutmann is cited in one of the answers with:

Any modern drive will most likely be a hopeless task, what with ultra-high densities and use of perpendicular recording I don't see how MFM would even get a usable image, and then the use of EPRML will mean that even if you could magically transfer some sort of image into a file, the ability to decode that to recover the original data would be quite challenging.

More over the typical suggestion to make a raw copy of the disk and use the copy for recovery attempts is misleading. With failed drives that may be a possible solution, but also puts a lot of stress on the drive which may be counter productive. In your dd-scenario though this is different and looks like a quite moronic approach. Recovering data that was overwritten with dd by creating a copy with dd for further recovery approaches? That shouldn't give you anything else than what dd previously wrote, right? Now of course if you want to prove that Peter Gutmann's or more advanced methods still work with newer drives, you only want to read from the source drive and don't write to the drive to prevent further overwriting of data.

Honestly, trying to recover all data will be almost impossible, waste a lot of time and bind resources (the drive cannot be used and the computer must continue the recovery process) that you could have easily avoided by creating backups and being more careful with such dangerous commands.

Related Question