Hard Disk Restore From DD Image Gone Bad!!!

Posted on 2006-05-02
Last Modified: 2008-02-26
I was restoring my laptop from a backed up disk image sitting on my server.  I was using a combination of dd and netcat to restore the image to my laptop's hard disk.  I accidentaly used "of=imagename.img" instead of "if=imagename.img", now my backed up image's size reads 0k instead of 80GB!  I'm dropping my question here because I imagine my only hope to recover my data is through the use of the forensic tools found on the Helix live cd.
Prior to sending my laptop's hard disk to the service center for repair, I wrote zeros to the disk to wipe everything clean, then it was returned with factory default software.  Is there any chance I could restore the data that existed before I wrote zeros to the disk?  Or do I have a better chance of trying to restore the image sitting on my server?  I knew the second I accidentally overwrote the backed up image, that I should unmount the partition and create an image of it, but it's a production machine and it that wasn't an option.  I might be able to do it after hours, but by that time I'm sure theres a good chance the physical location of my backed up image's data will be overwritten with other files, etc..
I extremely desperate for some sort of solution.  I greatly appreciate any suggestions anyone may have!!!
Question by:etherbreeze
    LVL 4

    Expert Comment

    Let me understand, - you issued on the server, where the only backup image resided
    something like: of=imagename.img |netcat ... ? In other words - has it been overwritten on the server or on the laptop ,after downloading through netcat? Has dd written its usual xxxx records in
    xxxx records out? without issuing errors?

    Author Comment

    That's exactly what I did.  The laptop had nothing on it - It was booted to Knoppix, and I ran 'netcat -l -p 10001 | dd of=/dev/hda'.  On the server, I ran 'dd of=image.img | netcat 10001'.  Once I issued the command on the server, dd instantly completed on the laptop and the server continued to run the command for about 20 to 30 seconds while I frantically tried to kill the process...  Once it completed, the image on the server read 0k.
    DD did return to records in/out with no error - on both the server and laptop.
    LVL 19

    Accepted Solution

    when your partition is reiserfs, you can restore deleted files using
    reiserfsck --rebuild-tree -S -l /root/recovery.log /dev/hdaX

    use this howto:

    when using ext2, there are tools also. ext3 can be managed as ext2, but once files get undeleted or not, you still need to recover the log data for ext3 to work again.

    other fs I frankly don't know

    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    Join & Write a Comment

    ​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
    BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (, affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    Internet Business Fax to Email Made Easy - With eFax Corporate (, you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now