5 ms·
One time I accidentally overwrote my hard drive with dd while making an installation thumbdrive. While unfortunate, it was only the first 8GB or so. This nuked
by alhirzel 4y ago
One time I accidentally overwrote my hard drive with dd while making an installation thumbdrive. While unfortunate, it was only the first 8GB or so. This nuked the partition table, bootloader, and start of the Windows partition, but fortunately my daily-driver, still-running Linux system partition was unaffected. I kept my cool and figured it was recoverable. I ended up recovering the partition table from RAM and writing it back to the disk and reinstalling a bootloader. Talk about a nervous reboot! I'm just glad the power didn't go out...
- AlexSW 4y agoHow did you get it out of RAM so cleanly?
- alhirzel 4y agoIt wasn't clean, I had to manually parse it out of /proc and triple check the math before committing it with fdisk.
- FrostKiwi 4y agoThat's pretty hard core. Any resources you recommend to understand the steps involved? Maybe a write-up by yourself?
- b0afc375b5 4y agoDo you have a blog post about this with more details somewhere?
- jonah-archive 4y agoI had something like this happen once -- a company I was at had these old RAID arrays that we kept limping along while we waited for budget to buy ones from a company that hadn't ceased to exist, and at some point a disk failed in some way that caused the RAID system to lose its internal partition table information (to my recollection... it's been awhile). I could still access the block devices, but couldn't instantiate the logical volumes, and dumping dd chunks showed that there was data there... so I wrote some code to scan the disk for ext2 magic numbers, and once I found them did some math on paper to find the partition boundaries and very... carefully... recreate them. I have a photo of the piece of paper here: https://www.flickr.com/photos/jedwards/4494268626/ https://www.flickr.com/photos/jedwards/4494268626/
- bentcorner 4y agoReminds of this story: https://www.ecb.torontomu.ca/~elf/hack/recovery.html https://www.ecb.torontomu.ca/~elf/hack/recovery.html (And its HN thread, with other recovery stories: https://news.ycombinator.com/item?id=25491790 https://news.ycombinator.com/item?id=25491790)
- pedrovhb 4y agoAh, this reminds me of the time a few years ago when I accidentally deleted `sudo`. A lot of stuff broke and it was interesting running around in a system where things would sort of work, but sort of not really. I learned then that sudo was really just a binary, so I tried to get a copy and put it in the right place. I couldn't, though, because I didn't have write permissions to it without sudo! In hindsight I guess I could've just run the binary itself to get access, or put it elsewhere on my $PATH, or use `su` instead. Not sure if I tried those things, it was a while ago and I was pretty new to Linux. Maybe I got the file from the internet and didn't know to make it executable. Anyway, what I ended up doing was booting up from a live Ubuntu USB and copying the sudo from the live environment to my installation on disk. It worked, and my newbie self felt like a proper hacker, fixing the unfixable. For one day I was a heart transplant surgeon :)
- alhirzel 4y agoNice solution and good instincts! I bet you’re a pretty advanced user by now. I used to keep an Arch Linux bootable thumb drive around as sort of an insurance policy against things like this. Good reminder for me…
- jcubic 4y agoThis reminds me my old Laptop with Linux installed that had Optical drive broken and no USB boot option, there was also no option to buy new Optical Drive. I was moving directories around to make some space on root directory. I've moved /var/ to /home directory and create symlink and it worked. But then later I wanted to do the same with /usr directory that had all shared libraries in /usr/lib/. In the process of moving files got some error I was not able to use any binary file like cd, ls or ln. Only applications that was running was working. I was certain that the laptop was dead and I will not able to use it anymore since I will not be able to install new system. So the task was to copy somehow all my important data. Luckily I was using Firefox and I've had FireFTP installed, so I've borrow my mother Windows laptop and installed FTP server and was able to copy my data over WiFi. Later it turns out that you could buy used DVD burner for that laptop, so it was resurrected and after installing Windows XP I've given that laptop to my mother.
- nedt 4y agoOh yeah overwriting the partition table can be "fun". Once wrote the partition table of a floppy to my hard drive. That was when I was still running DOS. Used a disk hex editor (I think it was part of pctools) to change it back to the correct values.
- alhirzel 4y agoThat's gnarlier than what I faced, kudos to you.
- Fethbita 4y agoThat’s great, I had the same problem but didn’t hack it like you did unfortunately. I overwrote the first 30 GB of my 6 TB HDD and am trying out GetDataBack Pro to get my files back, no luck so far. I had some tens of thousands of photos that I can’t replace.
- alhirzel 4y agoI'm sorry that happened! What filesystem was it?
- hanche 4y agoOh, what fun! Our system administrator decided once to duplicate the boot partition of a server, so we had a spare should the usual one fail. He used dd of course. And the next day, he was off to a USENIX conference. What he had forgotten, though, was that the first partition on the disk actually contained the partition table! (This was on Solaris, or possibly SunOS.) Since the source disk and the target disk had different partition tables, things started falling apart. It did not happen all at once, probably due to caching. But we started getting more and more weird errors. It took me half the day to figure out what had happened. By great luck, I had actually saved a copy of all partition tables just a few days prior. They were in human readable form, but good enough for me to restore the damaged partition table to its original state. A reboot later, all problems were gone.