I have accidentally overwritten my file

Puh, that was a day.

I was changing things on a drawing and then saved it accidentally as another existing file. And worse, I accepted the dialog for overwriting. Yeah. Fxxk.

Ok. I did a huge mistake. But, still, maybe there is a way to get back the file. Luckily, the software I use for drawing 3d models uses an JSON formatted file and I remembered at least one word that shall be in the file(LedHalterArm).

After a bit of research, I found a way to read out what’s still on the hard disk.
First, I moved the file that I have overwritten and gave it a new name:

mv GameboyBeleuchtungV5.d3ddoc GameboyBeleuchtungV5.d3ddoc.bak

That shall remove the link to the part of the hard disk.

The next task was to find the position on hard disk, for that a unique string should be used and makes the search easier.

grep -a -b "LedHalterArm" /dev/sda3

Unfortunately, I already exported this as STL file so it gave me mostly unrelated results but some of them seemed to be possible. I got some results like

123123123: "name": "LedHalterArm"

Ok, let’s try again with the more specific search term.

grep -a -b "\"name\": \"LedHalterArm\""

Here, we are, I’ve got 3 results and took the last one as starting point.

48020388426:                "name": "LedHalterArm"
94465072989:                "name": "LedHalterArm"
94465073068:            "name": "LedHalterArm",

Let us see what is there:

dd if=/dev/sda3 count=16 skip=$(expr 94465073068 / 512)

Yey :) I’ve got at least the file contents from the point of “LedHalterArm” to the end. From here now I have to go back on the hard disk until I reach the beginning of the file. This process took the most of the time, because I did it step by step.

I reduced the expr value by 512 and increased the count by 1:

dd if=/dev/sda3 count=11 skip=$(expr 94465072556 / 512)

Later on I increased the steps by factor 10 then factor 50 and finally I got the whole text. For easier handling I added a clear command to the front, with that I didn’t need to care about where the beginning is of my result. Just scrolled up.

clear && dd if=/dev/sda3 count=336 skip=$(expr 94464908716 / 512)

So, I copied the relevant part from the console into a file and saved it. It worked.