In this article, we’re going to explore one of my favorite programs, GNU ddrescue!

ddrescue is a data recovery tool that works like dd, but with very useful features that enable data recovery from damaged block devices, whether it be a harddrive with bad sectors, a floppy disc, or a scratched CD.

ddrescue can copy blocks from one device to another, just like dd, and has a similar syntax.

Background

I used this program almost every day for years while doing systems administration and support at UCSB. Even when I wasn’t trying to recover data, I used ddrescue as a replacement for dd just in case the block device I was copying from did happen to have a problem. It also has a great logfile feature (which the manual recommends you should use unless you know what you’re doing) that put my mind at ease with long-running block operations that were at some risk of getting interrupted by power failure, server issues, or just some other unfortunate happenstance.

Use Cases

Use Case #1

Anyways, enough of that, let’s look at a real world scenario. You’ve got an old spinning harddrive from your laptop and it has a bunch of photos from your college years on it. The drive is clicking and when you boot up the laptop the OS tends to freeze within a few hours. On Linux, we see a bunch of I/O errors in dmesg. (Note, if you see these, don’t run a filesystem repair, as you will likely make things worse).

Use Case #2

This one’s a bit more exotic, but I have used it before. Say you have two copies of the same optical media. You know, CD, DVD, etc. Let’s say each copy is scratched such that you can’t read the data or listen to the music or watch the video or w/e your optical media is for.

What to do first

First, if it’s still booted, and you have small, extremely important files on the drive (documents), get the copied off now via email or USB drive or whatever. I’m talking important documents or small pictures that you don’t have a backup for, not your iTunes collection.

Setup/Install our Environment

OK, now that you’ve got the real stuff safe, let’s see what else we can pull. Turn the laptop off and boot Ubuntu or some other Linux distro you like. For external drives you can just plug them into an existing Linux box.

You’ll need free space on a drive that is larger than the full size of the drive you’re trying to recover, generally. ddrescue will output a sparse image with -S (if your FS supports it). For peace of mind, just get enough space. Though, with the log file you won’t lose any progress if you fill up the target disk anyways.

OK, almost ready to actually recover data. Let’s install ddrescue. On Debian, the package is gddrescue, for GNU ddrescue. The package named ddrescue on Debian actually gives you dd_rescue, which is an older version. For other distros, make sure you get the GNU version, not the Kurt Garloff version (more discussion here).

If your distro doesn’t have a ddrescue package, you can download the source code here.

You get get it on Mac OS X via Homebrew.

If you’re looking to run ddrescue on Windows, you can install it using Cygwin.

Now, make sure your source block device is unmounted. In the first pass, we’re going to read all of the blocks we can without retrying ones that give us errors.

Simple Damaged Drive - Use Case #1

Open up a shell and run this command with root privileges, substituting /dev/sda for your messed up disk. If you’re not sure, a quick fdisk -l might help you figure it out. The process is non-destructive, so worst case, you backup the wrong drive:

$ ddrescue /dev/sda imagefile logfile

The above will copy all (readable) blocks from /dev/sda to imagefile, and save a log of it’s progress in logfile. This way, if we need to cancel the transfer (or it’s interrupted), we won’t lose our progress.

So, that’s all you really have to do. ddrescue is smart enough to do what’s best for your block device in most cases. After going through and copying all that it can without errors, it will go back through and retry anything it had trouble with.

Recovery with Multiple Copies - Use Case #2

So, this is less common, as I mentioned, but if you do have 2 CDs with scratches, run the command from Use Case #1 twice. One time on the first CD, once on the second. Use the same logfile and the same destination file, this way ddrescue only has to check the second CD for the parts that it could not read from the first.

$ ddrescue /dev/cdrom imagefile logfile

When finished, take out the disc and insert another copy, then continue:

$ ddrescue /dev/cdrom imagefile logfile

If all goes well, imagefile will be complete. If not, and you have additional copies of the CD, keep trying!

Summary

  • If you need to recover data from a hard drive you think might be damaged, use ddrescue
  • Make sure you’re using GNU’s ddrescue, not dd_rescue
  • Let ddrescue do it’s own thing unless you really know what you’re doing
  • Always use the logfile/mapfile

Note on references

  • This is another article that originally came out of my work at UCSB, like the LFTP article elsewhere on this blog.
  • The original article references a page on forensicswiki.org original source of this info. The info on both pages is now out of date. ddrescue doesn’t do “splitting” anymore, it does “scraping”. There’s also usually no need to pass specific options as presented in these articles.