Data Recovery Post Mortem

After still recoverying (myself, and my data) from a recent loss, here are the most important things to learn from my mistake. But first, a quick “how we got there”:

The Disk Destroyer

I wanted to create a bootable USB stick with the Ubuntu installer. As usual, I would copy the ISO image onto the stick using the dd if=./Ubuntu.iso of=/dev/sdb command. As it turns out, the outputfile of=/dev/sdb was my 4TB photo collection, instead of the 8GB USB stick, which was dev/sdd. As it so happened, I was working on the backups, creating a new one, and not having the old anymore. So first thing I tried was fsck.ext4. But the filesystem was in a quite damaged state apparently, so this made it worse. Long story short: 5 GB ISO written to the wrong disk, and 3.6TB disappeared from the drive.

Lessons Learned

1. The most important. If you suspect data loss, make a backup first. Even if you think it’s a minor issue and you will be able to recover it with what you want to do next. Any writing to the disk will probably make it worse.
2. Don’t use dd. Researching this post, I found out, that people also call it Disk Destroyer. Use a tool that asks for confirmation before writing, and shows the size and the name of the disk.
3. If you program a tool, make it hard to misread or mistype things that are important. /dev/sdb and /dev/sdd differ by one letter, so it’s prone to human error.

Recovering

I’m currently carving the data left and piecing together the last remaining fragmnets of the filesystem using UFS Explorer, which seems to work quite well for ext4, and r-studio (not the R IDE), which is a bit more involved graphically. It’s a lengthy and tedious process, iny my case the whole filestructure is gone, and I still need to sort out corrupted and bogus files.

So moral of the story (besides the lessons learned above): Don’t make backups, sometimes. Let your PC do them. Continuously, and by itself. It’s more reliable than you.