Recovery of Overwritten Data via DDRescue, etc

[WhiteHawk]

Hi all!

I made a huge mistake using Microsoft’s’ “diskpart” to “clean” a ~2 terabyte drive and install Windows 11 on top of data contained within said drive. This drive contains some of the most important data that’s crossed my system, and I’m hard-set on recovering the data within.

This disk is, as mentioned before, approximately 2 terabytes in capacity; contained a single partition spanning the drive in the ext4 file system; and has a GPT partition table.

I have utilized multiple utilities to only analyze the drive, such as “TestDisk” and “EaseUS Data Recovery”, and have found what I expected: most of the drive’s contents remains in-tact, with artifacts of a clean installation of Windows 11.

Those who would be so kind as to advise me: how may I go about recovering this data best? I am rather inept with regards to Linux functions, if I’m to say, and would appreciate both said help, as well as such a consideration.

[Dutch_Master]

Depends how much you value the lost data, you might want to try a professional data recovery service. But that’s not cheap, for sure.

For starters, use the Sysrescuecd distro, as it gives you a GUI so you’re not stuck on the cli. Mind, a lot of functions do need the cli.

First step is to make a 1:1 copy of the drive to a secondary drive, at least equal in size. Linux has the dd tool to do just that:

dd if=/path/to/failed/drive of=/path/to/target/drive

This will take a long time.

Next, use the photorec tool to see if it can recover any data. Use the copy drive as source and direct the recovered files to yet another drive. You may want to repeat this step several times with various options. See the man page for photorec on which options are available and how to invoke these.

HTH!