0

I was trying to burn an iso image to a DVD with the command:

sudo dd if=/path/to/iso.iso of=/dev/sdb bs=1024k status=progress

However, I ended up overwriting about 1.4 GB on my USB drive which had important data on it before I killed the process with Ctrl+C! I had like 10 GB of data on the drive, so it's not all gone. I tried to recover the data with testdisk, but I can't find the data. I know that PhotoRec could recover photos and videos from my USB drive, but I also had .odt, .docx, .pptx and many other types of files. I also had my encrypted diary on the USB drive (with its private key).

Is there any way I could recover the data? I know that the USB drive was formatted with NTFS.

P.S. After this, I corrected the command to:

sudo dd if=/path/to/iso.iso of=/dev/sr0 bs=1024k status=progress

This command returned an error message saying the /dev/sr0 is read-only despite that the DVD was completely blank and not used before.

Kamil Maciorowski
  • 69,815
  • 22
  • 136
  • 202
Kseniya Kolokolkina
  • 11
  • 4
  • 1
    Long time since I used it, but TestDisk and PhotoRec were the two main ones recommended to me back in the day. If you have access to a windows machine, "Recuva" from ccleaner.com is another free option. Use "Deep Scan", and "Non-deleted files" in settings for the most thorough search. – Stax Jun 06 '22 at 01:49
  • overwritten data is almost always unrecoverable. https://www.stellarinfo.com/blog/why-it-is-impossible-to-recover-data-from-an-overwritten-hard-drive/ Data recovery software relies on the way filesystems are used (in that generally new data is written to a new location, leaving the prior data intact on disk), but dd executes below the filesystem level, so it will overwrite any data in the blocks it is operating upon without knowledge of or regard for what is already there. – Frank Thomas Jun 06 '22 at 03:24
  • 1
    Welcome to Super User. (1) Please take our short [tour] to see how the site is designed to work. What you observed with `/dev/sr0` is a separate "problem". There should be one problem per question. (2) Your question may be closed as a duplicate of [this one](https://superuser.com/q/241817/432690), because `photorec` and similar programs are usually the best one can do at home. (3) One can straightforwardly read from `sr0`, but writing is more complicated. To burn a DVD you still need a dedicated program, e.g. `cdrecord`. – Kamil Maciorowski Jun 06 '22 at 05:18
  • It still saddens me that people don't have backups. Entrust your entire life to a single device that could be dropped in a puddle, left on a bus, run over by a car, zapped by a power spike… "Any data not stored in at least three distinct locations ought to be considered temporary". – Tetsujin Jun 06 '22 at 08:40
  • It's a misnomer that `photorec` is only for media files, as it's purpose is to search for and recover file types based on extension and supports >100 extensions – JW0914 Jun 07 '22 at 09:41

1 Answers1

0

First, you can try to create a binary file from your USB drive:

dd of=~/myusb.bin if=/dev/sdb bs=4M (of course replace /dev/sdb with your USB device path)

Then I recommend you to try binary forensics tools, which detect file headers to recover whole files, like:

cactuschibre
  • 180
  • 8