Cloned OS onto 3TB storage instead of USB stick

Help with issues regarding installation of Debian

Cloned OS onto 3TB storage instead of USB stick

Postby I messed up bad » 2017-06-05 04:57

I will be on here waiting and responding

I accidentally cloned tails onto, not the target usb stick but a several terrabyte external drive that was used by windows. Not only did it have all the most important files, but it wasnt mine. I feel sick.


Closed tails to see if windows could see the HDD which it couldnt.

Please tell me at least some of the data will.be recoverable? Could tails have annihilated all that data in a couple of minutes?

I remember it said converting to fat32, then started erroring, something about didnt find g something? Found mrb, or mht
Last edited by I messed up bad on 2017-06-05 09:38, edited 1 time in total.
I messed up bad
 
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

Postby dilberts_left_nut » 2017-06-05 05:05

Posting actual details will help.
What filesystem was on the external?
What does "cloned" mean?
AdrianTM wrote:There's no hacker in my grandma...
User avatar
dilberts_left_nut
 
Posts: 4658
Joined: 2009-10-05 07:54
Location: enzed

Re: Oh God is this external HDD data recoverable?

Postby I messed up bad » 2017-06-05 05:12

Im sorry im freaking out and am currently unable to look at the hardware in question.

It was a windows pc and if I recall correctly the moment I realised the dreadful error was when I looked at the device selection it said USB something 3000gb. Maybe it was ntfs, but I doubt it is anymore.

Ok so the process I was undertaking was loading tails on the pc (boot from usb) then use a program included with tails to convert a target usb stick to bootable tails drive. It of course says all data will be wiped on the target device.

Thankyou
I messed up bad
 
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

Postby dilberts_left_nut » 2017-06-05 05:25

OK, not familiar with TAILS, but I suspect it hasn't wiped the entire drive - that would take a long time.
Presumably it has overwritten the start of the drive up to the size of the image.
Any data that was there will be unrecoverable.
You may be able to recover data from the rest of the drive with a tool like testdisk / photorec or there may be windows based ntfs specific tools that could help too.

Best case is you might get some back, depends also on the type of data you're attempting to recover.

It's probably worth pointing out that you should definitely NOT write anything to that drive (at least until you give up trying to get anything back).
AdrianTM wrote:There's no hacker in my grandma...
User avatar
dilberts_left_nut
 
Posts: 4658
Joined: 2009-10-05 07:54
Location: enzed

Re: Oh God is this external HDD data recoverable?

Postby I messed up bad » 2017-06-05 05:37

Thankyou dilberts nut. I greatly appreciate your help.

Perhaps the drive was exFAT, I dont know.

There is some brief useful information here on tails installation I will leave the url rather than copying

https://tails.boum.org/contribute/desig ... /#index3h1

^ which explains why the removeable device was no longer readily visible in windows

The main pertinent information is that a 2.5gb partition is made on the storage device using GPT and the rest of the drive is left unpartitioned (for creating a persistence drive after the first boot of the tails OS)

Im curious (when im not having a panic attack) why the installation didnt complete properly. issue related to 3gb hdd?

Tails doesnt seem to have a forum but if there is somewhere more appropriate to ask I can go there instead.
I messed up bad
 
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

Postby dilberts_left_nut » 2017-06-05 05:57

OK so you might be down to a 2.5GB loss.

If you've never done anything like this before, and the data is important, I would suggest you find a reputable local data recovery service that you can pay to recover the data for you.

If you want to 'have a go' get a bootable copy of testdisk and see what it can see (preferrably on a clone or image - but you will need 3TB of space available to make such).

I messed up bad wrote:Not only did it have all the most important files, but it wasnt mine. I feel sick.

On the plus side - there is TWO more people in the world that now understand the importance of backups :D
AdrianTM wrote:There's no hacker in my grandma...
User avatar
dilberts_left_nut
 
Posts: 4658
Joined: 2009-10-05 07:54
Location: enzed

Re: Oh God is this external HDD data recoverable?

Postby I messed up bad » 2017-06-05 07:16

Seems there are issues with gpt on larger hard drives sometimes. tails isnt meant to be installed on large drives, and im a little worried that the hdd will act weird now per some of the stories im reading.

Im trying to get my head around whether a 3Tb image is necessary or if I oughtn't just have a practise run on testdisk (maybe even replicate the disaster on an old external for the dry run). Im no expert but I cant think of an obvious scenario where the external will be inadvertently modified.

Thanks dilbert. Its not true what my fellow Aussies say about new Zealanders.
I messed up bad
 
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

Postby dilberts_left_nut » 2017-06-05 08:03

I messed up bad wrote:Seems there are issues with gpt on larger hard drives sometimes. tails isnt meant to be installed on large drives, and im a little worried that the hdd will act weird now per some of the stories im reading.
gpt is designed to solve problems that mbr has with large drives.
Im trying to get my head around whether a 3Tb image is necessary or if I oughtn't just have a practise run on testdisk (maybe even replicate the disaster on an old external for the dry run).
That's a very good idea to become aquainted with the process on disposable data.
Im no expert but I cant think of an obvious scenario where the external will be inadvertently modified.
The process of recovering data (or attempting to) may likely involve rewriting the mbr data and recreating/restoring from surviving backup sectors the partition tables, headers and mft - if this goes badly there may not be any second chances. The other option is photorec that attempts to parse files from the raw disk data, which is limited to well defined filetypes, is easily defeated by fragmentation and results in files without the original filenames or folder structure and a not insubstantial portion of partially recovered files.
Thanks dilbert. Its not true what my fellow Aussies say about new Zealanders.

It's not true what your fellow Aussies say about most things ... :)
AdrianTM wrote:There's no hacker in my grandma...
User avatar
dilberts_left_nut
 
Posts: 4658
Joined: 2009-10-05 07:54
Location: enzed

Re: Oh God is this external HDD data recoverable?

Postby v&n » 2017-06-05 08:15

+1 to using testdisk for recovery.
Testdisk Step by Step : https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

I messed up bad wrote:Im trying to get my head around whether a 3Tb image is necessary or if I oughtn't just have a practise run on testdisk (maybe even replicate the disaster on an old external for the dry run)..

Testdisk runs in read-only mode until you decide to 'Write' the partition table it finds after a quick or 'Deeper Search'. Before doing that, it lets you browse the filesystem it has discovered (using the 'P' key to list files, arrow keys to navigate across directories). So if you don't think it found what you had expected, you can always quit the program (pressing 'q' a number of times) without writing anything to the disk.

But since you are a beginner, yes it is indeed a good idea to get some practice with it before doing the actual thing.

If you have the option available to make an image of the drive and work on that, just do it right away. Don't waste any time thinking whether to do it or not. Since the problem is only logical and the drive is physically healthy, it won't take too long to image the whole drive (provided you use some smart tool like 'gddrescue', not the traditional 'dd' program).
v&n
 
Posts: 595
Joined: 2015-02-04 02:57

Re: Oh God is this external HDD data recoverable?

Postby I messed up bad » 2017-06-05 08:27

So step one, aquire a 3Tb disk and fill it with an image of the mess i've made, using gddrescue.

Im glad to get a second endorsement for testdisk because reading through the forum didnt fill me with optimism.
I messed up bad
 
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

Postby I messed up bad » 2017-06-05 08:31

At this point I seem to be using you guys for data recovery advice and nothing to do with a botched debian install.
I messed up bad
 
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

Postby dasein » 2017-06-05 11:11

I messed up bad wrote:Im glad to get a second endorsement for testdisk because reading through the forum didnt fill me with optimism.

You needn't worry. You are in exceptionally good hands. Both d_l_n and v&n are among the few folks around here whose advice/input/guidance I'd trust without question.

I messed up bad wrote:So step one, aquire a 3Tb disk and fill it with an image of the mess i've made, using gddrescue.

Yes! Except it's more like Step 0. Do not so much as look at the damaged drive until this step is complete.

Edit: Purely pedantic point: It doesn't have to be a 3TB drive; it has to be at least 3TB. That is to say, the destination drive must be at least as large as the source, but can be larger.

One note of caution, wrapped in a caveat. I'm OCD about backups, so it's been ages since I've had to resort to photorec, which means that my information may be dated. That said, the last time I used it, it could recover a file, but not the name. Depending on how many files actually got clobbered, be prepared to spend weeks/months reconstructing file names.

Since the damaged drive is a Windows disk, you might solicit advice from folks more expert in Windows; there may be other tools/options/etc. that folks here simply do not know about.

I messed up bad wrote:At this point I seem to be using you guys for data recovery advice and nothing to do with a botched debian install.

You weren't installing Debian in the first place. :mrgreen:
Last edited by dasein on 2017-06-05 12:20, edited 1 time in total.
User avatar
dasein
 
Posts: 7775
Joined: 2011-03-04 01:06
Location: Terra Incantationum

Re: Cloned OS onto 3TB storage instead of USB stick

Postby I messed up bad » 2017-06-05 12:07

Ok. Tails says it is debian-based and they dont seem to have a support forum. I was hoping for some insights into what the installer actually did to the disk and per the info I posted from the tails site, it seems likely that a 2.5gb partition was dropped on the start of the hard drive. After more research I have reason to hope that the secondary drive header thing can be used to restore the entire file system save what was overwritten.

I will use your advice and take my question to a windows forum.

Youve all been most gracious and magnanimous strangers. Thankyou.

I shall have to try debian one day.
I messed up bad
 
Posts: 26
Joined: 2017-06-05 04:49

Re: Cloned OS onto 3TB storage instead of USB stick

Postby dasein » 2017-06-05 12:17

I messed up bad wrote:Ok. Tails says it is debian-based...

Yeah, and you're "based" on your parents, but that doesn't mean that you "are" your parents. Literally half the distros on the planet claim to be "based" on Debian.

I messed up bad wrote:After more research I have reason to hope that the secondary drive header thing can be used to restore the entire file system save what was overwritten.

If such a thing exists on an NTFS volume, you might be able to use it as you describe. (Sorry, but I know nothing about NTFS except how to spell it.)

BTW, don't let the key lesson get lost in all this talk of recovery. As d_l_n pointed out, this is a valuable lesson about backups, for both you and your friend. Restoring from backup is always quicker and easier than restoring/recreating.
User avatar
dasein
 
Posts: 7775
Joined: 2011-03-04 01:06
Location: Terra Incantationum

Re: Oh God is this external HDD data recoverable?

Postby sunrat » 2017-06-06 01:05

I would never attempt an install without full backups being completed. The opportunities for FUBAR are numerous.

dilberts_left_nut wrote:It's not true what your fellow Aussies say about most things ... :)

I resemble that remark! I say true things sometimes. ;)
“ computer users can be divided into 2 categories:
Those who have lost data
...and those who have not lost data YET ”
Remember to BACKUP!
User avatar
sunrat
 
Posts: 2016
Joined: 2006-08-29 09:12
Location: Melbourne, Australia

Next

Return to Installation

Who is online

Users browsing this forum: No registered users and 4 guests

fashionable