3

Accidentally wrote /dev/zero to the first 371MB of a 500GB disk. Is it possible to rebuild the partition table and/or recover what data hasn't been overwritten?

2 Answers2

1

try TestDisk, this is pretty much the only tool that can save something off ext3

Aleksandar Ivanisevic
  • 3,417
1

If only the first part of disk overwriten, the bacup superblock may help you

  1. you could use mke2fs -n /dev/sdx to see the superblock location
  2. if all backup superblock mke2fs -n provide is wrong, you could scan it hexdump /dev/sdx| awk '$6 == "ef53"' for example
0000430 9eb6 6465 0000 ffff ef53 0001 0001 0000
8000030 9eb6 6465 0000 ffff ef53 0000 0001 0000
...

0x0000400(0000430-30) is main superblock,0x8000000(8000030-30) is backup superblock
if block size is 4k(0x1000), superblock of 8000030 is (0x8000030-0x30)/0x1000=32768

verify by dumpe2fs -o superblock=32768/dev/sdx, if it dump information, it may be the filesystem you are using.

  1. e2fsck -b 32768 /dev/sdx to fix superblock and continue fsck.
Charles Chou
  • 118