On Tue, Sep 26, 2023 at 11:14:15PM -0400, Nick Holland wrote: > To recover sd1e, you need to recreate a disklabel that matches what > was there before...exactly. To the sector.
Re-creating the disklabel is obviously the primary focus in these situations - the data which has been overwritten is gone if it's not backed up elsewhere, but non-overwritten stuff can potentially be recovered. Once piece of advice, which is sadly probably too late for this particular case, but very, very useful to know and remember for the future: * The kernel keeps it's working copy of the disklabel in memory. * If you know this in advance, what this means is that if you overwrite a raw disk device and realise what you've done, just keep cool. Immediately hit ^C, and invoke disklabel. Since you were dd'ing to a raw device, you were likely already logged in as root and doing other things related to partitioning, etc. Even if you've overwritten the boot and root partitions, things like ksh and the disklabel binary are likely in the buffer cache. If you can get in to disklabel and display the label for the trashed disk, then note it down somewhere, even if that means writing it down on paper. Having this information is the key to any recovery of data that was not overwritten.
