On Wed, Feb 27, 2008 at 6:56 AM, Ian Malone <ibmalone@xxxxxxxxx> wrote: > Brian Chadwick wrote: > > > Morgan Read wrote: > > >> [root@morgansmachine DiskBUImagesEtc]# dd if=/dev/sda > >> of=2ndstage.rescue bs=1K count=1280 > >> 1280+0 records in > >> 1280+0 records out > >> 1310720 bytes (1.3 MB) copied, 0.0535238 s, 24.5 MB/s > >> [root@morgansmachine DiskBUImagesEtc]# chown morgan: ./2ndstage.rescue > >> [root@morgansmachine DiskBUImagesEtc]# dd if=zImage-LAB-20060421.htc > >> of=/dev/sda > >> 2348+0 records in > >> 2348+0 records out > >> 1202176 bytes (1.2 MB) copied, 0.117155 s, 10.3 MB/s > >> [root@morgansmachine DiskBUImagesEtc]# > >> > > > >> So, fingers firmly crossed, have I managed to copy enough of my hard > >> drive with the first two commands to be able to patch back the > >> catastrophic damage I seem to have done with the last command. Could > >> someone more confident than I give me some instruction:) > > > > sorry ... dd is final ... it did what you said as a root user. dont you > > love linux ... it does EXACTLY what you say when you are root. > > > > The point was Morgan has an accidental sort-of backup of the bit > he dd-ed over. > > -- > imalone > > Good catch Ian. I had not paid attention to that fact. You have the first 1.3 megs of /dev/sda backed up to 2ndstage.rescue. So you could reverse your dd command as follows dd if=./2ndstage.rescue of=/dev/sda and that would replace the start of /dev/sda back with what was originally there before you overwrote it (because thankfully you backed it up before overwriting it). The one caveat is if the data at that location that has since changed from current activities on your box then restoring that data back to its previous state could cause problems. I did an md5sum of that block on my system and then created & removed an empty file on /boot (the first partition on the device) and re-hashed with no change so the data did not change in those first 1280K as a result of creating a file on the first partition of that device. It was a pretty basic test but hopefully a reflection of your situation. You have your critical data backed up. At this point I'd risk reversing the dd command to replace those first 1280K with the original data that you backed up to ./2ndstage.rescue. Jacques B.
