Any way to recover a partition after writing zeros with DLG?

[Ken g6]

I once did something kind of like this. I ran Cygwin in Windows, and I'd just discovered /dev/snd. So I was writing stuff to that on occasion; but I accidentally wrote a bunch of stuff to /dev/sda instead! 😱

Now, I had two partitions on that drive. The first one was a backup partition; the second had my actual data. I eventually found a Linux program (don't remember the name of it) that identified the location of the remaining partition on the drive and re-built my partition table. I then set up a new MBR with Windows Setup, and everything went back to normal. 🙂

So the question is, did your partition start at the beginning of the disk, or did you have some space (possibly in another partition) before what you want to recover?

 

[taltamir]

The Quick mode only wipes the first and last ~100MB of the disk (basically erases the partition table, FAT, MBR, and anything that might be redirected/remapped to the last sector). Most of the data will still be there but no you can't recover the partition data because that's been wiped for good. You could use a disk editor (RAW) to recreate/redefine the partition but you'd need to already know how the partition was defined or have a backup of it.

That would explain it.
Pretty pathetic if the zero fill secure erase is actually not doing a full zero fill. But it works in the OP's favor, as it means he didn't actually zero fill the drive (he thought he did, he told the program to do so, but the program didn't because its junk).

I would certainly not be using that program for my secure erase needs.

 

[energydream2007]

If the partition you had is NTFS use testdisk to find that partition and do a partition recovery. NTFS keeps two copies of the File Allocation. One usually in the beginning of the drive, which probably got wiped and elsewhere... usually in the middle of the drive. Find that and you'll be in good shape.

Keep in mind there are two types of data recoveries... partition and file signature. You'll want to do your VERY best to stay in the partition (and file system) portion. It's more accurate.

Yes it was one big NTFS partition of 298 GiB with no OS on it.
I did tried TestDisk 6.11.3 and it didnt find anything in the deep scan. (maybe cause it wasnt run i dos mode - il try it again).

You said the best way is to stay in the partition portion - do you have recommended ways to do it man?

In Quick Mode all you did was write zeros to the boot sector. A full zero write takes a long time and once done, you recover no data unless you have a lab that can read data edges.

Yes that true but it still called zero fill even if its quick (nor that it feels the whole drive but just portion of it)

I once did something kind of like this. I ran Cygwin in Windows, and I'd just discovered /dev/snd. So I was writing stuff to that on occasion; but I accidentally wrote a bunch of stuff to /dev/sda instead!

Now, I had two partitions on that drive. The first one was a backup partition; the second had my actual data. I eventually found a Linux program (don't remember the name of it) that identified the location of the remaining partition on the drive and re-built my partition table. I then set up a new MBR with Windows Setup, and everything went back to normal.

So the question is, did your partition start at the beginning of the disk, or did you have some space (possibly in another partition) before what you want to recover?

Well like i said it was one big partition no other partitions.
*If u can try to remember the name of the soft it will be nice to try it 😉
*About re-building your partition table and the new MBR - can you describe it in steps man? (so if i will be in your position i will know what to do) tnx man

 

[strep3241]

Try using a program called File Scavenger.

 

[energydream2007]

Iv tried that but its just keep searching with no find in both modes man