How to recover data after dd?

Question

linux

I made a terrible mistake. I confused my main 3 TB screw with a flash drive and tried to write the Windows image there via dd. After 10 seconds, I turned off the screw and the recording was interrupted. Only then did I understand where I wrote it down ... Help, is it possible to save the data? There's just a sea of ​​them. It was the main repository of all my information... I'm shocked

Answer 1

How many sections were there?
You have lost the information from the partishontable and the beginning of the first partition. This information is almost impossible to recover.
The information from the following sections is quite easy to recover.
1. Make a full byte-by-byte copy of the disk.
2. Perform all subsequent actions only on a copy of the disk.
3. Try using the utilities to create a new partichantable. If everything goes as it should, everything except the first partition will be restored automatically.
4. Look for critical files from the first section by signatures. Well, it probably won't be good.

Answer 2

Well, the partition table and part of the disk table of contents (and maybe - depending on the speed of the disk - the entire table of contents and the beginning of the data) flew out into the pipe. What has gone down the drain has already gone down the drain, you can try to restore the partition table. To do this, I think it's best to turn to Zettabyte - he's a real specialist on disks.

Answer 3

I'm afraid that everything is very, very bad. Of course, there are utilities that extract information by content ... But, I think that it's a seam. Make backups next time....

Answer 4

Help, is there a way to save the data?

Yes, but not all. What was overwritten by dd within 10 seconds cannot be restored - this part is lost forever.
Further depends on what file system was on the overwritten disk.
If NTFS, then connect the drive to a Windows computer, download the free R.saver and do a full scan: https://rlab.ru/tools/rsaver.html
Restore the found data to another drive (R.saver is different and will not ), any programs must also be saved there. If Windows prompts you to format or initialize your disk, be sure to refuse.
If the disk had FS ext3, ext4, and the like, then the situation is worse. Discard any free software immediately, download and do a full scan, for example, with UFS Explorer:https://rlab.ru/tools/ufs_explorer.html
This is a paid program, but all functions, except for saving found files, are available before purchasing a license. Files up to 256 KB can also be saved for free. Those. you can see what is on the disk that has been overwritten by the image.
Given the specifics of ext*, recovery results are likely to be worse - many folders and files will be found in RAW (raw) and will not have names. But this needs to be checked.
Since your HDD is physically healthy, creating an image (cloning) of it seems to be optional. The only thing is to refrain from experimenting with any hard disk recording with lost information.
No need for any chkdsk, recreating the partition table, etc. I doubt that this will be done correctly, especially given the fact that there was a lot of data.