Undoing wipefs

If you’re reading this right now because you just ran wipefs -a on the wrong disk or partition, you’re probably enduring¬†that familiar data loss sinking feeling. In the case of a disk, you might be able to restore your partition table using something like testdisk, or, if you still have the output of wipefs, you can directly “undelete” what wipefs just deleted.

Suppose you just ran the following command and killed /dev/sda:

# wipefs -a /dev/sda
/dev/sda: 8 bytes were erased at offset 0x00000200 (gpt): 45 46 49 20 50 41 52 54
/dev/sda: 8 bytes were erased at offset 0x3b9e655e00 (gpt): 45 46 49 20 50 41 52 54
/dev/sda: 2 bytes were erased at offset 0x000001fe (PMBR): 55 aa
/dev/sda: calling ioctl to re-read partition table: Success

You can run the following commands to write the recently-deleted bytes back to disk:

echo -en '\x45\x46\x49\x20\x50\x41\x52\x54' | dd of=/dev/sda bs=1 conv=notrunc seek=$((0x00000200))
echo -en '\x45\x46\x49\x20\x50\x41\x52\x54' | dd of=/dev/sda bs=1 conv=notrunc seek=$((0x3b9e655e00))
echo -en '\x55\xaa' | dd of=/dev/sda bs=1 conv=notrunc seek=$((0x000001fe))
partprobe /dev/sda

As you can see, it’s a matter of filling the bytes at the end of each line of¬†wipefs into the echo command and copying the offset into the seek parameter in dd.

Make sure you double-check these values before running these commands or you could end up in a worse predicament!

Leave a Reply

Your email address will not be published. Required fields are marked *