4

I'm trying to be calm... and will try to explain this as best I can.

I was trying to use the dd command to burn an iso image to a 16GB MicroSD for my RaspberryPi. I had my 2TB USB hard drive also connected on the other USB-C slot and by accident, I completely wrote over the 2TB drive of important files instead of the 16GB MicroSD!

The command I executed was:

sudo dd bs=4m if=PlexMediaPlayer-1.3.4.699-1d4f6da1.RPi2-arm.img of=/dev/disk2

Where /dev/disk2 was the 2TB external USB drive. The output of the command was:

137+0 records in

137+0 records out

574619648 bytes transferred in 19.313496 secs (29752234 bytes/sec)

The drive now has the contents of what was originally in the .img file intended for the 16GB MicroSD. Everything else is gone from the 2TB external USB Drive.

My whole life is in that 2TB hard drive, including the photos of my kids since they were small, etc. I can't imagine what else was lying in that drive.

I'd really appreciate any help anyone can provide. :-(

Community
  • 1
andresi
  • 41
  • 1
    Just to clarify, was this a backup drive (your question refers to it as a backup drive)? If so, what sort of backup drive was it (e.g. a Time Machine backup or something else)? Also, can you please edit your question to explain exactly what you did (commands and all) so we can get a clearer idea what I completely wrote over the 2TB backup drive means? Please also add how long it took. – Monomeeth Jul 07 '17 at 07:25
  • @Monomeeth I edited the post as you suggested. Apologies as I have not been asking many questions in StackExchange. – andresi Jul 07 '17 at 07:34
  • 1
    See https://apple.stackexchange.com/questions/54953/what-should-i-do-after-i-lost-my-macbook-data?rq=1 and similar posts – nohillside Jul 07 '17 at 08:33
  • 1
    I concur with @patrix - those are good solutions to this problem. In short, do two things: 1) stop using the drive immediately 2) download and use data recovery software. My preference is Disk Drill it's free to scan and analyze and you only pay if you are going to recover things. Finally - *make and keep backups of that drive * – Allan Jul 07 '17 at 08:53

1 Answers1

1

First step: create a bit for bit copy of the destroyed drive using the dreaded dd command which took down your drive in the first place. Make sure you disable Time Machine and any other background application which wants to write on your disk (Spotlight aka mds is another one).

Second step: start trying to pull data off the copy (don't use the original except as read only until you've recovered your data).

I used to use Prosoft's Data Rescue 2 & 3 but the new version requires an internet connection (for no good reason). I can't recommend it on principle. Cleverfiles's Disk Drill at least lets you preview your data before you pay. You could try Lazesoft Mac Data Recovery which is donationware. If Lazesoft gets your files back, you should donate (generous programmers deserve to be rewarded). Some of flash drive manufacturers included file recovery utilities, SanDisk RescuePro program has worked for me but maintaining a licensed copy is such a hassle I don't think I have one now.

If the first data recovery program fails you, you can try some others. Even if the data recovery programs destroy your backup, you can always do another bit to bit clone to try with other programs.

Single step version:

I've just noticed that even free Disk Drill includes a workflow with built-in byte-to-byte copy to DMG routine which would be easier to implement and get you off the command line right now.

Just proceed with "Backup / Backup into DMG-image". The unique aspect of the byte-to-byte backups is the fact they actually store the contents of data sectors that were marked as empty, not occupied by data. Yes, you get it right, the sectors where your lost data can still reside. Once the backup disk image is created, you may start your hard drive recovery from the image instead of the real hardware. This will ensure the final failure will not occur while Deep Scanning, more data stays safe and potentially recoverable.

As others pointed out, keeping backups is really, really important as everyone makes mistakes and bits fry every once in a while.

Good luck getting your important personal archives and photos back!

Foliovision
  • 1,041