I written an ISO image to my hard disk using sudo dd if=image.iso of=/dev/sda. I meant /dev/sdc, and now running sudo fdisk -l returns only one partition on /dev/sda while there is supposed to be 6. Is it possible to recover my data?
I didn't shut down (reboot) my computer yet.
Since your computer is still on, you have a good chance of saving things.
First, sysfs exposes the kernel's in memory view of partition tables. Right now, your kernel has not reread the disk's table and it remembers your partitioning. Inside /sys/block/sda/, there should be one directory for each partition. Each such subdirectory contains a file start and a file size, which represent the partition's location and size, in sectors. Run fdisk and then recreate each partition (in order!) with the information in its sysfs directory. Note that you will have to create a new partition table, too. Make sure your new partition table is the same as the one before. You can check this in /sys/block/sda. If you see sda1 up to sda7 while you only have 6 partitions, you likely had MBR, and otherwise it was probably GPT. You also need to set flags and types for these partitions. Look at /etc/fstab and try to glean information about the types of partitions you have, then check Wikipedia to convert those to codes for your partitioning scheme.
Since you appear to be able to use your filesystem, it's likely that your dd did not get to overwrite any of it, since most of the important bits of a filesystem are at the front. Check /etc/fstab to see which partitions correspond to what part of your system, and then use the amount of data dd copied to get an estimate of how much you nuked. If you overwrote only part of a filesystem a good fsck might be able to fix it a bit (but you've lost a good chunk of data).
Most likely, you overwrote /boot. You'll have to reinstall your kernel (with aptitude) and reinstall GRUB2 (with grub-install) (which got both its first and second stage destroyed). GRUB2 is configured with files in /etc, so you won't have to manually recreate anything.
I guess that you have no current backup, and I am sorry to read about your tough luck using
sudo dd if=image.iso of=/dev/sdx
where you used the drive letter x = a so that you were overwriting the beginning of your hard disk drive where you stored a lot of valuable data.
You are not the first person and I am afraid not the last person affected by this problem. dd is recommended at many web sites to be used like this. It is a powerful but dangerous method, because it does what you tell it to do without questions. For this reason it is often nicknamed 'Data Destroyer'.
@marcelm comments, that this nickname is unfair. He is right that writing directly to a device file as root is causing the risk. So please be aware that you can easily overwrite a drive and destroy valuable data by writing to the corresponding device file /dev/sdx. (Safer tools are listed at the end of this answer.)
Do as little as possible with the drive, and above all, do not write anything to it, because it can make the situation worse by overwriting data, that are still possible to recover.
If your data are valuable, you should work on a cloned copy, not the original (partly overwritten) drive. See this link, scroll down to 'Advanced repair of a partition table, file system and/or recovery of files'
If you had a GUID partition table, GPT, there is a backup of the partition table at the end of the drive /dev/sda, and you may be able to restore the main partition table from this backup table using the tool gdisk. See the manual man gdisk for details.
You may manage to restore the partition table and file systems using Testdisk from
Read the instructions at the CGSecurity web site and also the link provided by @ElderGeek, Partitions disappeared after power loss while installing
You may also manage to restore the partition table and file systems using gpart/gparted according to the link provided by @CSM,
HOWTO: Restore Lost Partitions to a Deleted or Corrupt Partition Table
PhotoRec: If you fail to recover the partition table and file systems, you can still recover some file data. The files at the head end, maybe 1-1.5 GB, are overwritten and lost, but files behind that part of the drive are still there. PhotoRec from http://cgsecurity.org is a tool, that can recover data 'from the drive surface' without a file system. Typical data in the beginning of common file types are used for identification.
The following link provides details about PhotoRec,
https://www.cgsecurity.org/wiki/PhotoRec
You should save the files to a partition in a separate drive.
It is not possible to recover the directory structure and it is usually not possible to recover the file names (and not the permissions and ownership), and there are problems, when files are fragmented, but many files can be recovered by PhotoRec (not only photos, also many other common file types). But, and this is a big but, it is a lot of hard work to wade through the huge amount of unsorted files to identify what are really important files, that you should rename to meaningful file names.
In the future, please use a tool that helps you identify and select the correct target device and that has a final checkpoint, so that you can double-check that you will clone from the iso file to the correct target device, for example
In Linux:
gnome-disks,In Windows: Win32DiskImager.
You can also use extracting tools, that provide a final checkpoint, for example
By your dd command, you overwrote the partition table of /dev/sda and all data as far as the size of image.iso goes.
So the best you can achieve is to restore your partition table (with exact sizes) to recover at least the partitions towards the end of /dev/sda.
Short of restoring from a backup, there is no way to fully recover. dd has overwritten the partition table and some of the data of the device.
If you drive is partitioned into separate / and /home partitions, and the /home partition was after the / partition, then you can recover your data. The MBR which lists where most partitions are has been overwritten. However, gparted can recover your /home partition.
This post on Ubuntu Forums gives some ideas on how to do it; I found that by searching for "gparted recover partition".
Once you've found your lost partition (in might be inside an extended partition), you should add it as the only partition in the partition table.
Once you've done that, you'll have to reinstall Linux, telling to keep the recovered partition as /home.
I can personally vouch for Testdisk which saved my data after I was repeatedly copying and pasting instructions for /dev/sdb and changing it to /dev/sdd which was my USB. Only one time I forgot to change it and there went my /dev/sdb into the dustbin.
/dev/sdaI strongly recommend creating a wrapper script: Prevent `dd` from destroying SSD or HDD. This ensures dd never writes to /dev/sda or possibly /dev/sdb or any other of your mass storage devices.
