Balena Etcher - clone drive, now have two blank drives

Well that’s a bit of a bugger but at least we’ve all learnt something:
Windows sucks.

Thanks for the offer but I just went through re-imaging the card/drive and going through the config again.
Second run through was faster!

The exact same issue happened to me today. Looks like both drives has been cleaned, as mentioned.

Lost some important files. :confused:

Release 1.5.109, Windows 10.

Should have updated…

@zvin

My hard was completely erased and partitioned as only 1 drive, and that was a very important drive with very important data for a machinery.

THIS WILL COST ME MY JOB !!

I NEED TO RECOVER THE DATA, PLEASE HELP ASAP

Hello @harderased

Did you use Etcher’s clone drive on Windows ?
Which Etcher version was it ?
The source drive was erased, right ?

If yes, do you know how the source drive was partitioned ?
Was it an MBR or GPT partition table ?
How many partitions were there ? What type of partitions ?
Do you have access to a computer running Linux ?

Yes it was windows 10
I deleted it to avoid ever using it again- downloaded on November 26
Yes was erased

No
I do not recall
it was a windows 7 drive
i do have a Mac laptop

Hello @harderased

Do you know how many partitions were on the drive ?
Were they fat32 or ntfs partitions ?
How large is that drive ?

I’ll assume that there was only one partition and that you have enough disk space on your mac to make a disk image of this drive.
The partition table is missing on that drive, so we need to find where the partition is.
If the drive was readable on Windows 7, I guess the partition is either fat32 or ntfs.

Do not format this drive if any system asks you to !

In order to recover data (on a mac):

Step 1: Find the offset of the partition

  • before connecting the drive, open a terminal on your mac and type diskutil list
  • connect the drive to your mac, if macOS tells you something like “this drive is not readable on this computer”, select “ignore”, DO NOT SELECT FORMAT;
  • run diskutil list again, a new drive should have appeared, note its name (something like /dev/disk2);
  • I will use /dev/disk2 in the commands below, please use the correct disk number from the previous step;
  • run sudo hexdump -C -s 512 /dev/disk2 | head which will show you the contents of the beginning of the disk (skipping the first 512 bytes).

You should see something like:

00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00100000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|
00100010  00 00 00 00 00 f8 00 00  3f 00 ff 00 00 08 00 00  |........?.......|
00100020  00 00 00 00 80 00 00 00  ff 17 b7 03 00 00 00 00  |................|
00100030  00 00 0c 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|
00100040  f6 00 00 00 01 00 00 00  31 0c 76 f0 2d 76 f0 9e  |........1.v.-v..|
00100050  00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb 68 c0 07  |.....3.....|.h..|
00100060  1f 1e 68 66 00 cb 88 16  0e 00 66 81 3e 03 00 4e  |..hf......f.>..N|
00100070  54 46 53 75 15 b4 41 bb  aa 55 cd 13 72 0c 81 fb  |TFSu..A..U..r...|

If you see the .R.NTFS on the third line of the output, this is an NTFS partition starting at 0x00100000 bytes (the number in the first column of the third line)= 1048576 bytes = 1MiB.

Another possible output would be

00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00100000  eb 58 90 4d 53 44 4f 53  35 2e 30 00 02 20 2c 09  |.X.MSDOS5.0.. ,.|
00100010  02 00 00 00 00 f8 00 00  3f 00 ff 00 00 08 00 00  |........?.......|
00100020  00 18 b7 03 6a 3b 00 00  00 00 00 00 02 00 00 00  |....j;..........|
00100030  01 00 06 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100040  80 00 29 24 bf 89 6e 4e  4f 20 4e 41 4d 45 20 20  |..)$..nNO NAME  |
00100050  20 20 46 41 54 33 32 20  20 20 33 c9 8e d1 bc f4  |  FAT32   3.....|
00100060  7b 8e c1 8e d9 bd 00 7c  88 56 40 88 4e 02 8a 56  |{......|.V@.N..V|
00100070  40 b4 41 bb aa 55 cd 13  72 10 81 fb 55 aa 75 0a  |@.A..U..r...U.u.|

If you see the .X.MSDOS5 on the third line of the output, this is a FAT32 partition starting at 0x00100000 bytes (the number in the first column of the third line) = 1048576 bytes = 1MiB.

We don’t really care what type of partition (fat32 or ntfs) it is, what we need is the offset: the number in the first column, 00100000 in both cases above. This is an hexadecimal number. So 0x00100000 = 1048576 = 1MiB

Step 2: Backup the partition

Copy the raw partition to a disk image with sudo dd if=/dev/rdisk2 of=copy.img bs=1048576 skip=1 (replace rdisk2 with the number of the disk from the previous steps and note the r before disk), this will take some time depending on the size of the drive.

Detail:

  • if=: input file;
  • /dev/rdisk2: the disk from the steps above, rdisk instead of disk will copy faster;
  • of=: output file;
  • bs=1048576: tells dd to copy 1MiB sized blocks;
  • skip=1: tells dd to skip one block at the beginning (which size is defined by bs= above) because out partition starts at 1MiB. This is the most important part, you need to adapt it according to the partition offset you’ve found in step1.

Now you should have a copy of the raw partition as copy.img in your home folder.

Step 3: Mount the partition

That’s the easy part: hdiutil attach copy.img

You should now see a new “drive” on your desktop, this is your partition.

Ich hatte das selbe Problem.

Mein Format war ExFAT.

Hat aber trotzdem geklappt,

I tried on a Mac i think the issue is from my side on the mac, Can you please post the same procedure on Windows 10, Thank You.

Been trying for 2 weeks.

@zvin Can you help please with the same procedure on windows, I am sorry but in need of the help.

Amr,

The instructions won’t work on Windows 10 as it lacks the same raw device access tools like dd which are required. The disk should be recoverable in your Mac though, or are you saying that it isn’t working there?

Rich,

I have managed to do as instructed above on a mac device, I have the copy.img file but I keep getting this message
The only drive that was backed up was the C drive, is there a way to the rest of the drives.

as you can see in the screen shot disk3 os the physical one that was erased by the bug in the application
disk4 is the image mounted which is only drive C

as i recall they were 4 or 5 drives NTFS
What can I do ?

Hi Amr,

You can also try using testdisk on your macOS to see if it can recover your partitions in your external drive. You may be able to install testdisk using homebrew: brew install testdisk

Once testdisk is installed, plug in the drive to your MacOS machine and if MacOS suggests formatting the drive, select ignore. On a terminal, run sudo diskutil list to see the drive path. It would show as /dev/disk3 (external, physical) if that is the only drive attached to your mac.

Now run testdisk using sudo testdisk. You can select creating a new log file. Select your disk from the list. It should show up like Disk /dev/disk3 from the list. Make sure that you select your external drive (we don’t want any more accidents). Select the drive then select Proceed. Select the Intel/PC partition. Then select Analyze and select quick search. It should scan the whole drive for any partitons. This might take an hour depending on your drive size.

It would show the partitions that it has detected. Check if these are the partitions that you want to recover. Hit enter to continue if the partitions were successfully detected. You should be then given an option to write the partition table to the disk. Select Write then confirm. Reboot your Mac once done.

I have used testdisk before at a past job to recover partitions on a RAID disk array that failed during a power outage. I hope it works for your as well. Let us know how it goes.

Regards,
Carlo

Hello Team Balena
running windows 7
Balena Etcher 1.5.109
tried to clone samsung evo 256gb sd cards
both cards wiped out
any help to get image back on card would be more than welcomed
I do not own a MAC, but I can borrow one

@humptycocco - thanks for letting us know you have a Mac available for troubleshooting, that helps a lot. Can you confirm the below as well before we send over instructions?

  • The source drive was erased, right ?
  • If yes, do you know how the source drive was partitioned ?
  • Was it an MBR or GPT partition table ?
  • How many partitions were there ? What type of partitions ?
    Thank you so much.

@kenna-smith
The source drive was erased, right ? will not boot up, raspberry pie cannot read sd card
yes, do you know how the source drive was partitioned ? going by this link Edit Partitions | Resizing the Raspberry Pi Boot Partition | Adafruit Learning System
Was it an MBR or GPT partition table ? GPT
How many partitions were there ? What type of partitions ? When i type df -k my screen looks like this(just with different #'s)
image

Hello @humptycocco

Only the partition table was erased (it is the list of partitions and their offsets on the drive), the partitions are still there on the drive.

Have you tried following the instructions from this post Balena Etcher - clone drive, now have two blank drives - #54 by harderased ?
testdisk should be able to find the partitions and recreate the partition table.

Otherwise you can try following Balena Etcher - clone drive, now have two blank drives - #44 by zvin which is manually doing what testdisk would do: looking for partition headers on the disk.

@humptycocco
testdisk is also available on Windows: TestDisk - CGSecurity

Hey bro,
How can i tell for sure what partition table type I need?
Is MBR correct?
After running Quick Search, both partitions appear in GREEN(* FAT 32 and P Linux)
I confirm WRITE with Enter, y and OK.
TestDisk displays You have to restart your Computer to access your data so press Enter a last time and reboot your computer.

I load image and start RPI3
Now I have a flashing cursor on my screen.
Image is supposed to autoexpand on first boot. Wait 3 minutes, turn off then start again.
Start up 2nd time and flashing cursor still there
Help!

Recovered my image
Anyone recommend a disk editor?