We had a human accident at home and an external hard disk was copied a SD 32gb image card by mistake. The copy should be done to a SD image.I guess 32gb of the external drive were overwritten, but as far as my knowledge of digital forensics, the most of the information should be there.Can you please recommend me a good low level scanner to analyse bit-to-bit the information in the whole hard disk to recover pictures and word files (mainly)?I used to know testdisk, is it valid for it?I hope you can give us a hand on this.Kindest regards
How to scan a hard disk at low level to recover files in partially overwritten partition?
linux;data recovery;forensics;testdisk
From my personal experience most filecarvers like to make assumptions based on which filesystems they detect. You could create a loop device with 32GB offset just to make sure your scanner/filecarver does not get sidetracked by seemingly valid data you're not interested in (i.e. skip the area you know was overwritten). Note the offset should be 512 Byte or 4K aligned. If you know the exact size of bytes that were overwritten, use that instead.losetup --find --show --read-only --offset $((32*1000*1000*1000)) /dev/sdxThen you can use any program of your liking on that loop device. photorec is one, there are others like foremost, scalpel, ... knock yourself out.If you had partitions / logical volumes that started beyond the 32GB mark you can also try testdisk. If you had a filesystem with redundant metadata you could try to fix that too, but you need to know the original partition offset (e.g. 1 MiB) and some way to locate the metadata backups.This is best done with overlays https://raid.wiki.kernel.org/index.php/Recovering_a_failed_software_RAID#Making_the_harddisks_read-only_using_an_overlay_fileAn overlay allows you to run fsck or some other programs that write on a virtual /dev/mapper/sdxoverlay device, without actually performing those writes on the real disk.