Data recovery - Help, I formatted the wrong disk

[Tafs]

Ok ... this time i really messed up, and i really need some help.
I was trying to install the rockbox firmware on my 1st gen iPod nano (2gb),
which requires the iPod to be windows formatted. Not having windows,
I read the instructions on this page, which led me to execute the following
commands in the terminal:

dd if=mbr-nano2gb.bin of=/dev/disk1
newfs_msdos -F32 -v iPod /dev/rdisk1s2

(the file in the dd command was downloaded from the previously linked page).

But, it turned out /dev/rdisk1 wasn't my iPod. It was my external firewire disk,
containing my video collection, backups, and a heap of other odds and ends.



Sending the disk in for professional data recovery is probably way beyond my (very) limited budget.
What i would like to ask any HFS gurus out there is, is there any hope of getting my files back?

Here's what i've found out so far:

The disk is a 320 GB WD MyBook Premium Edition. IIRC, the disk was previously
formatted using Disk Utility on an intel mac running Tiger, as one large journaled
HFS+ partition. This probably means that the disk is using the GPT partition format,
which means that there should be a backup of the partition table at the end of the disk.

These are my own investigations so far:

Last login: Sat Sep 15 11:36:55 on ttyp2
Welcome to Darwin!
sakaki:~ andreas$ fdisk /dev/rdisk1
Disk: /dev/rdisk1       geometry: 38913/255/63 [625142448 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 2: 0B   10   0   7 -  247 254  63 [    160656 -    3823464] Win95 FAT-32
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
sakaki:~ andreas$ gpt show /dev/rdisk1
      start       size  index  contents
          0          1         MBR
          1     160655         
     160656    3823464      2  MBR part 11
    3984120  621158328         
sakaki:~ andreas$

It seems as if the backup of the GPT partition table at the end of the disk is still intact,
so the damage done by my first command should be reversible,
but i'm not sure how I should restore the backup.

The second command might have caused more substantial damage,
by corrupting some of the data in the HFS+ file system. The new file system
that was created has also been mounted in the finder, which probably means
that a few folders and files have been created (.DS_Store, .Spotlight-V100,
.Trashes etc), causing further corruption. I can only speculate on the effects,
as i know absolutely nothing about the HFS/HFS+ file system.

I'll be thankful for any suggestions, tips and pointers you can provide,
and I'll do my best to answer any questions you might have.
In the meantime, I guess i'll start reading the HFS and HFS+ tech note ...

 

[Makosuke]

Sounds like you already know the basics of "Don't do anything with it", so the answer is to try this:

http://www.prosofteng.com/products/data_rescue_info.php

Data Recover II saved my butt once from a complete data corruption disaster once, and since you can preview what it's going to be able to get before you pay for it, there's nothing to lose.

TechTool Pro may also be able to salavage something from the file structure info, but I'd try Data Rescue II first and only give TTP a try if that doesn't do anything.

 

[Tafs]

Thanks - With the demo version of Data Rescue II i can see my files again
I'll just have to save up the $99 I guess. Then i get to spend a rainy afternoon sorting through the 11460 entries in the orphans folder