[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 541
  • Last Modified:

Hard Disk Restore From DD Image Gone Bad!!!

I was restoring my laptop from a backed up disk image sitting on my server.  I was using a combination of dd and netcat to restore the image to my laptop's hard disk.  I accidentaly used "of=imagename.img" instead of "if=imagename.img", now my backed up image's size reads 0k instead of 80GB!  I'm dropping my question here because I imagine my only hope to recover my data is through the use of the forensic tools found on the Helix live cd.
Prior to sending my laptop's hard disk to the service center for repair, I wrote zeros to the disk to wipe everything clean, then it was returned with factory default software.  Is there any chance I could restore the data that existed before I wrote zeros to the disk?  Or do I have a better chance of trying to restore the image sitting on my server?  I knew the second I accidentally overwrote the backed up image, that I should unmount the partition and create an image of it, but it's a production machine and it that wasn't an option.  I might be able to do it after hours, but by that time I'm sure theres a good chance the physical location of my backed up image's data will be overwritten with other files, etc..
I extremely desperate for some sort of solution.  I greatly appreciate any suggestions anyone may have!!!
0
etherbreeze
Asked:
etherbreeze
1 Solution
 
yuriskCommented:
Let me understand, - you issued on the server, where the only backup image resided
something like: of=imagename.img |netcat ... ? In other words - has it been overwritten on the server or on the laptop ,after downloading through netcat? Has dd written its usual xxxx records in
xxxx records out? without issuing errors?
0
 
etherbreezeAuthor Commented:
That's exactly what I did.  The laptop had nothing on it - It was booted to Knoppix, and I ran 'netcat -l -p 10001 | dd of=/dev/hda'.  On the server, I ran 'dd of=image.img | netcat 10.0.10.67 10001'.  Once I issued the command on the server, dd instantly completed on the laptop and the server continued to run the command for about 20 to 30 seconds while I frantically tried to kill the process...  Once it completed, the image on the server read 0k.
DD did return to records in/out with no error - on both the server and laptop.
0
 
Gabriel OrozcoSolution ArchitectCommented:
when your partition is reiserfs, you can restore deleted files using
reiserfsck --rebuild-tree -S -l /root/recovery.log /dev/hdaX

use this howto:
http://www.antrix.net/journal/techtalk/reiserfs_data_recovery_howto.comments

when using ext2, there are tools also. ext3 can be managed as ext2, but once files get undeleted or not, you still need to recover the log data for ext3 to work again.

other fs I frankly don't know
0

Featured Post

Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now