4TB Ntfs hdd, writt...
 
Notifications
Clear all

4TB Ntfs hdd, written (dd) 8GB iso image, possible recovery?

hajonnes
(@hajonnes)
New Member

Hi,

I have written a usb iso image to my archive hdd with the usual pictures of the kids and so on and no backup.
I had an 4TB hdd partitioned with gtp and formated under windows 7 with ntfs.
I wrote a ~8GB UDF partition to it.

Now I wonder what my chances are of recovering the drive.
I used "dd" under linux to write the image.

1)I was thinking of first checking if the $MFT is overwritten, I think it is. Suggestion of programs to verify it? Or should I use a hex editor?

2) checking if the backup GTP partition table and headers at the end of the disk are ok. Suggestion of programs?

3) Is there a copy of the $MFT outside MBR other than the $MFTMirr?

4) How do I locate $MFT or $MFTMirr if MBR is overwritten?

5) If I only have $MFTMirr and GTP partition table and headers what would be the best cause of action?

6) On a side note: I have a second hdd. This drive contains a partial directory structure similar to the broken does. To make this structure I transfered the files between the disks by copying the directory structure, not writing an image. The working drive can only be accessed from windows. Does that help?

I generally work in linux but I can boot a windows 7 partition as well.

Quote
Topic starter Posted : 09/06/2021 11:39 pm
jaclaz
(@jaclaz)
Community Legend

Some answers.

1) probably it is not (but has to be seen) the $MFT on a 4TB single NTFS partition should be beyond the 8 GB you have overwritten

2) you can try use gdisk:

https://www.rodsbooks.com/gdisk/walkthrough.html

but basically you can copy them back to the original initial sectors (via dd or any hex/disk editor) and then use *anything* to check them.

3) there is only one copy of the $MFT, the $MFTmirr is just a few initial records of the $MFT (and the $MFT is NOT inside the MBR)

4) you don't want (or need) a MBR (or of a copy of it) as the MBR DOES NOT contain any info about the filesystem, all the info available is in the bootsector (that on NTFS is the $Boot file), since all the needed info is in the BPB that is in the first sector of the $Boot file and there is mirror of it as the very last sector of the partition (i.e. outside the volume but inside the partition) that shouldn't be a problem

5) if you ONLY have those your only option is file based recovery (that may be a success or a total failure depending on a number of factors, mainly the fragmentation level of the filesystem (but even if successful you will likely lose metadata like filenames and dates, though if most of the files that need to be recovered ar JPEG one can rebuild some metadata from the internal ones).

6) No, it doesn't help (but it may help IF the simpler recovery attempts fail and the only remaining possibility becomes "negative" recovery, keep this other disk, but hopefully it won't be needed

To sum it up:

a. the $MFT may or may not have been overwritten (normally - in the sense of not as huge as 4 Tb volumes - the $MFT is created at a fixed offset of 786,432 clusters, so if the cluster size is the default one of 4K that means something like 786,432*8=6,291,456*512=3,221,225,472 so it would have been overwritten by 8 GB written via dd) it has to be seen if on such a large volume the default $MFT offset is to a higher address

b. first thing you should recover the mirror of the first sector of the $Boot file and have a look at it with a suitable viewer

c. in order to find it, easiest would be to search from the end of the disk towards the beginning for sectors with the "Magic Bytes" 55AA signature 

See the overall structure here:
http://www.ntfs.com/ntfs-partition-boot-sector.htm

All in all, if I were you I would try DMDE on that disk and see what it has to say.

https://dmde.com/

DMDE is available for both Linux and Windows, the free edition has only a few limitations that shouldn't affect your (hopefully) one time use, and when/if you wish to buy a license for it is affordable.

An alternative (Windows only) could be Isobuster, that unlike what the name suggests can "bust" *any* filesystem not only iso/cdfs:

https://www.isobuster.com/

If you want to do it manually you can use good ol' Tiny Hexer + my small structure viewers for it (again Windows only):

http://reboot.pro/index.php?showtopic=8734

The use of any of the above implies some knowledge of NTFS and its internal structures, if you have doubts, ask before writing/changing anything on disk.

jaclaz 

 

 

ReplyQuote
Posted : 10/06/2021 2:19 pm
Share: