0

I have a seagate 1tb harddrive. I had partitioned the hard drive into 2 sections. I was planning on using one partition to store files. The second partition, I had planned to make it a bootable usb for linux. I attempted to use dd on Mac Os X 10.12.1. I used the following command:

sudo dd if=kali-linux-light-2016.2-amd64.iso of=/dev/disk2 bs=1m

After executing this, I lost the two partitions (which had data on it). I know the data still remains on the hard drive, but when I plug in the external hard drive, I only have one small partition now for a bootable usb of linux that does not work. Can anyone suggest how I can restore my old partitions, I know the data has not been overwritten yet?

Improve this question
5
  • You overwrote data. Best go to your backup.
    – Ramhound
    Commented Nov 3, 2016 at 22:03
  • You are not providing any context about the kind of file systems that were involved.
    – Andrea Lazzarotto
    Commented Nov 4, 2016 at 12:47
  • I used OS X's disk utility to partition it from 1tb hard drive to two sections FAT32. The hard drive was originally formatted to be a back up drive with time machine (so I'm assuming probably formatted to Mac OS Extended (Journaled)). The second partition I made on the hard drive was about 75 gb. I then proceeded to use dd on OS X terminal to install the linux from the iso I had downloaded. So I used the diskutil command diskutil unmount /dev/disk2 then I attempted to use the dd command, but it said the drive was still in use.
    – Aj Kauffy
    Commented Nov 4, 2016 at 16:22
  • So I used diskutil unmountDisk /dev/disk2 and that when I used the command sudo dd if=kali-linux-light-2016.2-amd64.iso of=/dev/disk2 bs=1m Now when I plug the hard drive in, it shows that it is only formatted to about 1mb in size. So that's why I assume the data should still be recoverable. Please let me know if I can provide you with any other details.
    – Aj Kauffy
    Commented Nov 4, 2016 at 16:27
  • Please scan the drive with a data recovery tool like (for instance) Restorer Ultimate Pro or DMDE and then report back. The second partition is actually intact and you can restore it easily using Testdisk.
    – Andrea Lazzarotto
    Commented Nov 4, 2016 at 19:09

1 Answer 1

Reset to default
0

If you remember the exact size of the first partition, you can simply recreate the two partitions using the same partition manager you used before with the exact same size for the first partition. You've probably lost the beginning of the first partition because you overwrote it with the kali linux iso, but depending on the file system you had on it, you can repair the file system via fsck and get back most or all of the data that wasn't overwritten.

Assuming the size of the kali iso was smaller than the first partition, the data of second partition should remain unharmed. If you manage to recreate the partition at exactly the same location, that is.

Improve this answer
6
  • I partitioned it about 75 gb for the second partition. I'm unsure about the actual size of the first partition, but I only had about 300gb worth of data on the first partition, so if I repartition it to be at least 500gb, should I be able to recover the data?
    – Aj Kauffy
    Commented Nov 4, 2016 at 16:28
  • No. You need the exact size of the original first partition so that the start of the second partition matches the filesystem thats still on disk.
    – Pascal
    Commented Nov 4, 2016 at 16:54
  • BUT... maybe forensic software can help you. You need software that scans your disk for file systems. The first one will be broken, but the second one is probably still intact and can be copied somewhere using dd once you know its first block number.
    – Pascal
    Commented Nov 4, 2016 at 16:58
  • Trying to recreate the partitions over the old ones is terrible advice. Scanning the drive with Testdisk to rebuild a partition table would be much safer.
    – Andrea Lazzarotto
    Commented Nov 4, 2016 at 19:12
  • 1
    However, I'd add that it would make to first clone the disk, whatever you do. That way, if your first attempt fails, you can always returnto the original state.
    – Pascal
    Commented Nov 4, 2016 at 19:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .