On Sat, 01 Jun 2013 12:25:01 +0200, Louis Lagendijk wrote: >> Should I now format the 2TB disk using this command? >> $ sudo mkfs /dev/sdb1 > You could try without reformatting it: just check where it is mounted: > mount |grep sdb1 Hi Louis, I'm ready for the big dd! OK. Starting over after a reboot, given these two disks: A. The 500MB USB disk is the "good" disk B. The 150MB USB disk is the "bad" disk I run these commands (documented to help others on Centos): a. Open a wide window & type "sudo tail -f /var/log/messages" b. Plug in the good disk & note where it mounted: ==> Jun 1 08:26:39 rock kernel: usb 1-1.2: ==> new high speed USB device number 5 using ehci_hcd ==> Mounted /dev/sdb1 (Read-Write, label "SignatureMini", NTFS 3.1) ==> Cmdline options: rw,nosuid,nodev,uhelper=udisks,uid=503,gid=503,dmask=0077 ==> Mount options: rw,nosuid,nodev,uhelper=udisks,allow_other,nonempty,atime,fsname=/dev/sdb1,blkdev,blksize=4096,default_permissions c. $ mount | grep sdb1 ==> /dev/sdb1 on /media/SignatureMini type fuseblk (rw,nosuid,nodev,allow_other,blksize=4096,default_permissions) $ sudo mount /dev/sdb1 /mnt ==> Mount is denied because the NTFS volume is already exclusively opened. ==> The volume may be already mounted, or another software may use it which ==> could be identified for example by the help of the 'fuser' command. $ sudo umount /dev/sdb1 $ mount | grep sdb1 ==> reports nothing $ sudo mount /dev/sdb1 /mnt ==> reports nothing (but no errors either) $ mount | grep sdb1 ==> /dev/sdb1 on /mnt type fuseblk (rw,allow_other,blksize=4096) Here is where I had to reboot a moment ago ... but we can pick up from here now that I've repeated the commands without errors. >> 3) I assume here that your bad disk is already connected (as sdz check >> first what the real name is) OK. Now I connect the bad disk & check /var/log/messages: ==> Jun 1 08:34:26 rock kernel: usb 3-2: new high speed USB device number 2 using xhci_hcd ==> Mounted /dev/sdc1 (Read-Write, label "SignatureMini", NTFS 3.1) ==> Cmdline options: rw,nosuid,nodev,uhelper=udisks,uid=503,gid=503,dmask=0077 ==> Mount options: rw,nosuid,nodev,uhelper=udisks,allow_other,nonempty,atime,fsname=/dev/sdc1,blkdev,blksize=4096,default_permissions Doublechecking how the bad disk is mounted: $ mount | grep sdc1 ==> /dev/sdc1 on /media/SignatureMini type fuseblk ==> (rw,nosuid,nodev,allow_other,blksize=4096,default_permissions) > mount |grep sdc1 > and umount it to be sure OK. I will umount the bad disk: $ sudo umount /dev/sdc1 And, I check that the bad disk is unmounted: $ mount | grep sdc1 ==> reports nothing >> dd if=/dev/sdz of=/mnt/image.dd bs=1M >> This will copy the contents of your bad disk to image.dd > this now becomes: > dd if=/dev/sdc1 of=<path to the mount point for the new disk/image.dd OK. This is where we don't want to make a mistake! Q: Does the block size matter? $ dd if=/dev/sdc1 of=/mnt/image.dd When that finishes, I'll run: $ sudo chmod uog=r /mnt/image.dd And, then the recommended testdisk recovery steps. Wish me luck as I'm running the DD as soon as I send this (I was confused which block size you recommended, as you initially had 1M and then didn't have any size). NOTE: The detail will be put into a tutorial for Centos users which will have all the "idealized" steps, in sequence; so your kind efforts not only help me, but many others (we hope).