On a Linux distro on live boot, instead of dd if=myfile of=disk1, dd if=myfile of=disk2 was supplied, and disk2 got corrupted. Luckily, it failed without writing all. The disk has not written to since then. All the commands were executed on a live Linux session in RAM. The myfile mentioned here is an ISO file for a Linux distro.
Here is the iostat of the disk showing total blocks written on it, which shows 152648 KB_wrtn was overwritten.
iostat result – See /sda
This is what it looks like after overwritten:
Here is the result from a quick scan with the testdrive command using the quickscan option on hdd.
Result from testdrive ‘Quick Scan’
testdrive log file:
Wed Feb 4 21:18:09 2026
Command line: TestDisk
TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.12.63+deb13-amd64 (#1 SMP PREEMPT_DYNAMIC Debian 6.12.63-1 (2025-12-30)) x86_64
Compiler: GCC 14.2
ext2fs lib: 1.47.2, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.5
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop1 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop2 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop3 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop4 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop5 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop6 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - HGST HTS545050A7, FW:A3N0
Disk /dev/sdb - 7759 MB / 7400 MiB - CHS 1022 239 62, sector size=512 - TransMemory, FW:1.00
Disk /dev/loop0 - 3056 MB / 2915 MiB - 5970640 sectors (RO), sector size=512
Partition table type (auto): None
Disk /dev/sda - 500 GB / 465 GiB - HGST HTS545050A7
Partition table type: Intel
Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=4108 16450559
check_part_i386 2 type EF: no test
Current partition structure:
2 P EFI (FAT-12/16/32) 0 65 14 0 179 31 7200
Bad relative sector.
No partition is bootable
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
FAT12 at 0/65/14
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-6
FAT2 : 7-12
start_rootdir : 13
Data : 45-7196
sectors : 7200
cluster_size : 4
no_of_cluster : 1788 (2 - 1789)
fat_length 6 calculated 6
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
FAT12 at 0/65/14
FAT12 0 65 14 0 179 31 7200 [EFI System Partition] [NO NAME]
FAT12, blocksize=2048, 3686 KB / 3600 KiB
file_pread(4,16,buffer,26390607(1642/188/34)) read err: Partial read
file_pread(4,16,buffer,26398783(1643/63/20)) read err: Partial read
file_pread(4,16,buffer,26398799(1643/63/36)) read err: Input/output error
file_pread(4,1,buffer,26398799(1643/63/36)) read err: Input/output error
file_pread(4,16,buffer,26409086(1643/226/54)) read err: Partial read
file_pread(4,1,buffer,26409088(1643/226/56)) read err: Input/output error
file_pread(4,16,buffer,26466304(1647/115/5)) read err: Input/output error
file_pread(4,1,buffer,26466304(1647/115/5)) read err: Input/output error
file_pread(4,1,buffer,26466305(1647/115/6)) read err: Input/output error
file_pread(4,14,buffer,26466306(1647/115/7)) read err: Input/output error
file_pread(4,16,buffer,26476607(1648/23/39)) read err: Input/output error
file_pread(4,1,buffer,26476607(1648/23/39)) read err: Input/output error
file_pread(4,16,buffer,26488911(1648/218/58)) read err: Partial read
file_pread(4,16,buffer,26491374(1649/3/1)) read err: Partial read
file_pread(4,1,buffer,26491384(1649/3/11)) read err: Input/output error
file_pread(4,16,buffer,26996752(1680/119/56)) read err: Partial read
file_pread(4,16,buffer,27019390(1681/224/14)) read err: Input/output error
file_pread(4,1,buffer,27019390(1681/224/14)) read err: Input/output error
file_pread(4,16,buffer,27207806(1693/154/60)) read err: Partial read
file_pread(4,1,buffer,27207816(1693/155/7)) read err: Input/output error
file_pread(4,16,buffer,200061007(12453/56/35)) read err: Partial read
NTFS at 22336/35/36
filesystem size 331542528
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 22336 35 36 42973 180 23 331542528
NTFS, blocksize=4096, 169 GB / 158 GiB
NTFS at 42973/180/24
filesystem size 286398464
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 42973 180 24 60801 47 46 286398464
NTFS, blocksize=4096, 146 GB / 136 GiB
recover_EXT2: s_block_group_nr=0/0, s_mnt_count=13/4294967295, s_blocks_per_group=32768, s_inodes_per_group=128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 256
recover_EXT2: part_size 2048
Filesystem created: Fri Mar 29 06:14:54 2024
Last mount time: Sat Mar 30 21:51:58 2024
Linux 60801 47 47 60801 80 15 2048
ext4 blocksize=4096 Large_file Sparse_SB, 1048 KB / 1024 KiB
Results
FAT12 0 65 14 0 179 31 7200 [EFI System Partition] [NO NAME]
FAT12, blocksize=2048, 3686 KB / 3600 KiB
HPFS - NTFS 22336 35 36 42973 180 23 331542528
NTFS, blocksize=4096, 169 GB / 158 GiB
HPFS - NTFS 42973 180 24 60801 47 46 286398464
NTFS, blocksize=4096, 146 GB / 136 GiB
Linux 60801 47 47 60801 80 15 2048
ext4 blocksize=4096 Large_file Sparse_SB, 1048 KB / 1024 KiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 7200 linear /dev/sda 4108" | dmsetup create test0
echo "0 331542528 linear /dev/sda 358830080" | dmsetup create test1
echo "0 286398464 linear /dev/sda 690372608" | dmsetup create test2
echo "0 2048 linear /dev/sda 976771072" | dmsetup create test3
It seems two drives can be recovered, which must be D: and E: drives. But I also want C:
Known Disk Info
The partition was an MBR scheme of a 500 GB hard disk and something like this:
| about 500MiB System Reserved ][ around 100GiB C: system ][ around 120 GiB D: ][ around 130 GiB E: |
All the disks are in NTFS except the System Reserved, which is set by Windows. It had Windows 10 installed.
So, how do I proceed? I want to recover all partitions lost, which seems possible given that only System Reserved was overwritten.
