Scheduled Maintenance: We are aware of an issue with Google, AOL, and Yahoo services as email providers which are blocking new registrations. We are trying to fix the issue and we have several internal and external support tickets in process to resolve the issue. Please see: viewtopic.php?t=158230

 

 

 

Cloned OS onto 3TB storage instead of USB stick

Ask for help with issues regarding the Installations of the Debian O/S.
Message
Author
I messed up bad
Posts: 26
Joined: 2017-06-05 04:49

Cloned OS onto 3TB storage instead of USB stick

#1 Post by I messed up bad »

I will be on here waiting and responding

I accidentally cloned tails onto, not the target usb stick but a several terrabyte external drive that was used by windows. Not only did it have all the most important files, but it wasnt mine. I feel sick.


Closed tails to see if windows could see the HDD which it couldnt.

Please tell me at least some of the data will.be recoverable? Could tails have annihilated all that data in a couple of minutes?

I remember it said converting to fat32, then started erroring, something about didnt find g something? Found mrb, or mht
Last edited by I messed up bad on 2017-06-05 09:38, edited 1 time in total.

User avatar
dilberts_left_nut
Administrator
Administrator
Posts: 5346
Joined: 2009-10-05 07:54
Location: enzed
Has thanked: 12 times
Been thanked: 66 times

Re: Oh God is this external HDD data recoverable?

#2 Post by dilberts_left_nut »

Posting actual details will help.
What filesystem was on the external?
What does "cloned" mean?
AdrianTM wrote:There's no hacker in my grandma...

I messed up bad
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

#3 Post by I messed up bad »

Im sorry im freaking out and am currently unable to look at the hardware in question.

It was a windows pc and if I recall correctly the moment I realised the dreadful error was when I looked at the device selection it said USB something 3000gb. Maybe it was ntfs, but I doubt it is anymore.

Ok so the process I was undertaking was loading tails on the pc (boot from usb) then use a program included with tails to convert a target usb stick to bootable tails drive. It of course says all data will be wiped on the target device.

Thankyou

User avatar
dilberts_left_nut
Administrator
Administrator
Posts: 5346
Joined: 2009-10-05 07:54
Location: enzed
Has thanked: 12 times
Been thanked: 66 times

Re: Oh God is this external HDD data recoverable?

#4 Post by dilberts_left_nut »

OK, not familiar with TAILS, but I suspect it hasn't wiped the entire drive - that would take a long time.
Presumably it has overwritten the start of the drive up to the size of the image.
Any data that was there will be unrecoverable.
You may be able to recover data from the rest of the drive with a tool like testdisk / photorec or there may be windows based ntfs specific tools that could help too.

Best case is you might get some back, depends also on the type of data you're attempting to recover.

It's probably worth pointing out that you should definitely NOT write anything to that drive (at least until you give up trying to get anything back).
AdrianTM wrote:There's no hacker in my grandma...

I messed up bad
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

#5 Post by I messed up bad »

Thankyou dilberts nut. I greatly appreciate your help.

Perhaps the drive was exFAT, I dont know.

There is some brief useful information here on tails installation I will leave the url rather than copying

https://tails.boum.org/contribute/desig ... /#index3h1

^ which explains why the removeable device was no longer readily visible in windows

The main pertinent information is that a 2.5gb partition is made on the storage device using GPT and the rest of the drive is left unpartitioned (for creating a persistence drive after the first boot of the tails OS)

Im curious (when im not having a panic attack) why the installation didnt complete properly. issue related to 3gb hdd?

Tails doesnt seem to have a forum but if there is somewhere more appropriate to ask I can go there instead.

User avatar
dilberts_left_nut
Administrator
Administrator
Posts: 5346
Joined: 2009-10-05 07:54
Location: enzed
Has thanked: 12 times
Been thanked: 66 times

Re: Oh God is this external HDD data recoverable?

#6 Post by dilberts_left_nut »

OK so you might be down to a 2.5GB loss.

If you've never done anything like this before, and the data is important, I would suggest you find a reputable local data recovery service that you can pay to recover the data for you.

If you want to 'have a go' get a bootable copy of testdisk and see what it can see (preferrably on a clone or image - but you will need 3TB of space available to make such).
I messed up bad wrote:Not only did it have all the most important files, but it wasnt mine. I feel sick.
On the plus side - there is TWO more people in the world that now understand the importance of backups :D
AdrianTM wrote:There's no hacker in my grandma...

I messed up bad
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

#7 Post by I messed up bad »

Seems there are issues with gpt on larger hard drives sometimes. tails isnt meant to be installed on large drives, and im a little worried that the hdd will act weird now per some of the stories im reading.

Im trying to get my head around whether a 3Tb image is necessary or if I oughtn't just have a practise run on testdisk (maybe even replicate the disaster on an old external for the dry run). Im no expert but I cant think of an obvious scenario where the external will be inadvertently modified.

Thanks dilbert. Its not true what my fellow Aussies say about new Zealanders.

User avatar
dilberts_left_nut
Administrator
Administrator
Posts: 5346
Joined: 2009-10-05 07:54
Location: enzed
Has thanked: 12 times
Been thanked: 66 times

Re: Oh God is this external HDD data recoverable?

#8 Post by dilberts_left_nut »

I messed up bad wrote:Seems there are issues with gpt on larger hard drives sometimes. tails isnt meant to be installed on large drives, and im a little worried that the hdd will act weird now per some of the stories im reading.
gpt is designed to solve problems that mbr has with large drives.
Im trying to get my head around whether a 3Tb image is necessary or if I oughtn't just have a practise run on testdisk (maybe even replicate the disaster on an old external for the dry run).
That's a very good idea to become aquainted with the process on disposable data.
Im no expert but I cant think of an obvious scenario where the external will be inadvertently modified.
The process of recovering data (or attempting to) may likely involve rewriting the mbr data and recreating/restoring from surviving backup sectors the partition tables, headers and mft - if this goes badly there may not be any second chances. The other option is photorec that attempts to parse files from the raw disk data, which is limited to well defined filetypes, is easily defeated by fragmentation and results in files without the original filenames or folder structure and a not insubstantial portion of partially recovered files.
Thanks dilbert. Its not true what my fellow Aussies say about new Zealanders.
It's not true what your fellow Aussies say about most things ... :)
AdrianTM wrote:There's no hacker in my grandma...

v&n
Posts: 624
Joined: 2015-02-04 02:57

Re: Oh God is this external HDD data recoverable?

#9 Post by v&n »

+1 to using testdisk for recovery.
Testdisk Step by Step : https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
I messed up bad wrote:Im trying to get my head around whether a 3Tb image is necessary or if I oughtn't just have a practise run on testdisk (maybe even replicate the disaster on an old external for the dry run)..
Testdisk runs in read-only mode until you decide to 'Write' the partition table it finds after a quick or 'Deeper Search'. Before doing that, it lets you browse the filesystem it has discovered (using the 'P' key to list files, arrow keys to navigate across directories). So if you don't think it found what you had expected, you can always quit the program (pressing 'q' a number of times) without writing anything to the disk.

But since you are a beginner, yes it is indeed a good idea to get some practice with it before doing the actual thing.

If you have the option available to make an image of the drive and work on that, just do it right away. Don't waste any time thinking whether to do it or not. Since the problem is only logical and the drive is physically healthy, it won't take too long to image the whole drive (provided you use some smart tool like 'gddrescue', not the traditional 'dd' program).

I messed up bad
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

#10 Post by I messed up bad »

So step one, aquire a 3Tb disk and fill it with an image of the mess i've made, using gddrescue.

Im glad to get a second endorsement for testdisk because reading through the forum didnt fill me with optimism.

I messed up bad
Posts: 26
Joined: 2017-06-05 04:49

Re: Oh God is this external HDD data recoverable?

#11 Post by I messed up bad »

At this point I seem to be using you guys for data recovery advice and nothing to do with a botched debian install.

User avatar
dasein
Posts: 7680
Joined: 2011-03-04 01:06
Location: Terra Incantationum

Re: Oh God is this external HDD data recoverable?

#12 Post by dasein »

I messed up bad wrote:Im glad to get a second endorsement for testdisk because reading through the forum didnt fill me with optimism.
You needn't worry. You are in exceptionally good hands. Both d_l_n and v&n are among the few folks around here whose advice/input/guidance I'd trust without question.
I messed up bad wrote:So step one, aquire a 3Tb disk and fill it with an image of the mess i've made, using gddrescue.
Yes! Except it's more like Step 0. Do not so much as look at the damaged drive until this step is complete.

Edit: Purely pedantic point: It doesn't have to be a 3TB drive; it has to be at least 3TB. That is to say, the destination drive must be at least as large as the source, but can be larger.

One note of caution, wrapped in a caveat. I'm OCD about backups, so it's been ages since I've had to resort to photorec, which means that my information may be dated. That said, the last time I used it, it could recover a file, but not the name. Depending on how many files actually got clobbered, be prepared to spend weeks/months reconstructing file names.

Since the damaged drive is a Windows disk, you might solicit advice from folks more expert in Windows; there may be other tools/options/etc. that folks here simply do not know about.
I messed up bad wrote:At this point I seem to be using you guys for data recovery advice and nothing to do with a botched debian install.
You weren't installing Debian in the first place. :mrgreen:
Last edited by dasein on 2017-06-05 12:20, edited 1 time in total.

I messed up bad
Posts: 26
Joined: 2017-06-05 04:49

Re: Cloned OS onto 3TB storage instead of USB stick

#13 Post by I messed up bad »

Ok. Tails says it is debian-based and they dont seem to have a support forum. I was hoping for some insights into what the installer actually did to the disk and per the info I posted from the tails site, it seems likely that a 2.5gb partition was dropped on the start of the hard drive. After more research I have reason to hope that the secondary drive header thing can be used to restore the entire file system save what was overwritten.

I will use your advice and take my question to a windows forum.

Youve all been most gracious and magnanimous strangers. Thankyou.

I shall have to try debian one day.

User avatar
dasein
Posts: 7680
Joined: 2011-03-04 01:06
Location: Terra Incantationum

Re: Cloned OS onto 3TB storage instead of USB stick

#14 Post by dasein »

I messed up bad wrote:Ok. Tails says it is debian-based...
Yeah, and you're "based" on your parents, but that doesn't mean that you "are" your parents. Literally half the distros on the planet claim to be "based" on Debian.
I messed up bad wrote:After more research I have reason to hope that the secondary drive header thing can be used to restore the entire file system save what was overwritten.
If such a thing exists on an NTFS volume, you might be able to use it as you describe. (Sorry, but I know nothing about NTFS except how to spell it.)

BTW, don't let the key lesson get lost in all this talk of recovery. As d_l_n pointed out, this is a valuable lesson about backups, for both you and your friend. Restoring from backup is always quicker and easier than restoring/recreating.

User avatar
sunrat
Administrator
Administrator
Posts: 6412
Joined: 2006-08-29 09:12
Location: Melbourne, Australia
Has thanked: 116 times
Been thanked: 462 times

Re: Oh God is this external HDD data recoverable?

#15 Post by sunrat »

I would never attempt an install without full backups being completed. The opportunities for FUBAR are numerous.
dilberts_left_nut wrote:It's not true what your fellow Aussies say about most things ... :)
I resemble that remark! I say true things sometimes. ;)
“ computer users can be divided into 2 categories:
Those who have lost data
...and those who have not lost data YET ”
Remember to BACKUP!

v&n
Posts: 624
Joined: 2015-02-04 02:57

Re: Oh God is this external HDD data recoverable?

#16 Post by v&n »

dasein wrote:Both d_l_n and v&n are among the few folks around here whose advice/input/guidance I'd trust without question.
Thanks for the confidence dasein. I wish I had more time to devote to learning so I could be really worth the trust you seem to bestow upon me. Yes, I'm still clueless about the 'new changes' they have recently introduced in Linux systems. :/
dasein wrote:..it's been ages since I've had to resort to photorec, which means that my information may be dated. That said, the last time I used it, it could recover a file, but not the name.
It's still true about photorec, as far as I know from a 5-6 month old experience. Don't know if it has improved in that area in the meanwhile. And that's why photorec should be last option, when testdisk or any other tools the OP might try have failed.
dasein wrote:Since the damaged drive is a Windows disk, you might solicit advice from folks more expert in Windows; there may be other tools/options/etc. that folks here simply do not know about.
Agree. Although the last time (in 2014, if I remember correctly) I used a highly rated commercial windows-specific tool, called "Get Data Back" by runtime software, it took 24+ hours to recover less than half of the lost data (photos and videos of a studio) from a crashed hard drive that was physically healthy (let me admit that the drive was attached to my laptop via a cheap USB adapter, so that might be a factor in the ridiculously long time). Then just for giggles, I tried photorec on the same arrangement, and it recovered 100% data in less than an hour (yes the naming was a problem, but it didn't matter for the studio guy I was helping). Since then, I've never looked back at windows specific tools. But that may be partly because I've never needed to.

In one very specific hopeless case in 2009-10, where the drive was so bad that it wouldn't let any system boot that I tried connecting it to, I got unexpected success with the network edition of "Rtools", an old windows software, by booting the system with its 'rescue boot environment CD'. It was specially designed boot environment to handle such cases by ignoring drive errors during boot, then recover whatever was recoverable over network onto another system running its 'Agent' version. Other than that, I've never had any great success with windows tools that I couldn't have more efficiently with testdisk/photorec.

That said, software evolve all the time, and MS is trying harder than ever to cage their users within their commercial eco-system by introducing new 'features' that open software don't always work very well with. So yes, getting a second, third opinion from 'current' windows experts may be worth it.

User avatar
phenest
Posts: 1702
Joined: 2010-03-09 09:38
Location: The Matrix

Re: Cloned OS onto 3TB storage instead of USB stick

#17 Post by phenest »

I messed up bad wrote:Please tell me at least some of the data will.be recoverable?
This would depend on how full the HDD was before you messed it up. If it's 3TB, then you'll need something equally as big to copy over the recovered files. It also depends on how fragmented the Windows partition was. The more it was fragmented, the harder it will be to recover whole files.
ASRock H77 Pro4-M i7 3770K - 32GB RAM - Pioneer BDR-209D

v&n
Posts: 624
Joined: 2015-02-04 02:57

Re: Cloned OS onto 3TB storage instead of USB stick

#18 Post by v&n »

phenest wrote:It also depends on how fragmented the Windows partition was. The more it was fragmented, the harder it will be to recover whole files.
If testdisk or any other tool succeeds in restoring the previous filesystem, the recovered files that have not been overwritten will be intact, even if fragmented. The broken file problem due to fragmentation is a concern only if the OP has to resort to photorec or a similar tool that does the recovery using 'forensics' mode.

Also, 3TB or larger empty drive is needed only for creating image of the drive in question, and work on that instead of the drive itself. The space required for storing the recovered files will obviously be equal to the size of 'recoverable' data on the drive.

User avatar
phenest
Posts: 1702
Joined: 2010-03-09 09:38
Location: The Matrix

Re: Cloned OS onto 3TB storage instead of USB stick

#19 Post by phenest »

If the drive is fragmented enough, the OP may have over-written some of the fragments, making recovery of whole files impossible.

If the HDD is 3TB and there is little free space, it's stands to reason that a lot of the data will be the users personal data. Therefore a large drive will be needed.

Until the OP responds, we can only guess as to the extent of the damage and drive usage, etc.
ASRock H77 Pro4-M i7 3770K - 32GB RAM - Pioneer BDR-209D

User avatar
dasein
Posts: 7680
Joined: 2011-03-04 01:06
Location: Terra Incantationum

Re: Oh God is this external HDD data recoverable?

#20 Post by dasein »

v&n wrote:I'm still clueless about the 'new changes' they have recently introduced in Linux systems. :/
You and me both! (And it's an ignorance I have every intention of cultivating actively. :mrgreen:)
v&n wrote:
dasein wrote:...the last time I used [photorec], it could recover a file, but not the name.
It's still true about photorec, as far as I know from a 5-6 month old experience. Don't know if it has improved in that area in the meanwhile.
Given how photorec works, it'd be moderately surprising if it had. But I felt obliged to offer the caveat, just in case.
v&n wrote:So yes, getting a second, third opinion from 'current' windows experts may be worth it.
Ya never know. And it couldn't hurt to ask.

Post Reply