Score:0

Recovering partially wiped hard drive

cl flag

I'm using Ubuntu 18.04 and long story short, I accidentally ran a terminal command to write over my hard drive with zeros. It ran for a few seconds before my machine crashed. Now I've been struggling for the past few hours to get my computer back to normal and I'm in pretty deep.

Upon rebooting I found that I could boot into grub rescue mode similar to this. However I found none of my drives and partitions were being recognized, and that the solution in that question was not going to work. I would have expected (hd0, msdos1) to be the partition I needed, but it didn't even recognize this as a linux drive.

I plugged in a live USB and viewed /dev/sda1 with gparted. This was the partition where the damage was done. It was damaged in such a way that gparted could not even recognize it was a linux drive. I figured that repairing this was the first step.

I ran fsck on /dev/sda1 but got the error discussed here involving bad superblocks. I then took followed the solution there, and keep trying block numbers until I got something that worked, and let e2fsck run. It was quite a few blocks deep until I got one that worked. I'm honestly not too sure what this command did, I wanted it to at least straighten out the file system and fix the structure so I could play around with it in gparted and I could figure out what exactly was deleted after. This seemed to actually work at first because gparted was then picking up the drive.

Now I'm in a place where I boot up and I'm essentially getting this. However, I follow the solution and when I get to the final command "normal", grub doesn't start. Upon further investigating with my live USB, I found the following: /dev/sda1 has about 150GB / 250GB occupied which is about how much data I had on the drive (good news, most of it wasn't deleted). However, when I mount it with nautilus and peek inside I'm seeing \bin, \root, \dev, \usr, etc but they are all EMPTY. Also some essential files such as vmlinuz.mod and missing which explains the lack of being able to start up. So its probable that running e2fsck to recover the structure of the drive just messed the whole thing up.

Overall, basically I believe that some core files were deleted from the drive that need to somehow be restored, and that entire structure of the drive is now lost and needs to be recovered. Most of my data seemingly intact though.

I'm at a complete loss right now on what direction to go. I can provide more details if need be. I really need some help on this or I've essentially lost a lot of data.

Nmath avatar
ng flag
You cannot recover anything that was overwritten. For things that have not been overwritten you might be able to recover files using data recovery tools like testdisk and photorec. These are advanced tools and could cause further data loss if you don't know what you're doing. As far as the actions you mentioned in your narrative: STOP! You are making additional changes to the drive and you will just end up overwriting even more blocks which will result in additional data loss. You should make a bit-for-bit clone before making any changes to the disk. Oh, and in the future- BACKUPS!
Score:0
pk flag

You have erased a file system superblock which contains an index of files stored on your disk. You need to use a full data recovery program such as PhotoRec on your disk to recover the file information again. PhotoRec works by scanning the disk for file signatures and magic numbers that it recognises (like JPEG headers on images). Unfortunately, it is unlikely you will ever recover the file name and other file system metadata, like access times, owners, path on the disk, but you will at least be able to recover at least some of the file itself (i.e. the image in case of a JPEG mentioned).

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.