In this article, we’re going to explore one of my favorite programs,
ddrescue is a data recovery tool that works like
dd, but with very useful
features that enable data recovery from damaged block devices, whether it be a
harddrive with bad sectors, a floppy disc, or a scratched CD.
ddrescue copies blocks from one device to another, just like
dd, and has a
I used this program almost everyday for years while doing systems administration
and support at UCSB. Even when I wasn’t trying to recover data, I used
ddrescue as a replacement for
dd just in case the block device I was copying
from did happen to have a problem. It also has a great logfile feature (which
the manual recommends you should use unless you know what you’re doing) that put
my mind at ease with long-running block operations that were at some risk of
getting interrupted by power failure, server issues, or just some other
Use Case #1
Anyways, enough of that, let’s look at a real world scenario. You’ve got an old
spinning harddrive from your laptop and it has a bunch of photos from your
college years on it. The drive is clicking and when you boot up the laptop the
OS tends to freeze within a few hours. On Linux, we see a bunch of I/O errors in
dmesg. (Note, if you see thse, don’t run a filesystem repair, as you will
likely make things worse).
Use Case #2
This one’s a bit more exotic, but I have used it before. Say you have two copies of the same optical media. You know, CD, DVD, etc. Let’s say each copy is scratched such that you can’t read the data or listen to the music or watch the video or w/e your optical media is for.
What to do first
First, if it’s still booted, and you have small, extremely important files on the drive (documents), get the copied off now via email or USB drive or whatever. I’m talking important documents or small pictures that you don’t have a backup for, not your iTunes collection.
Setup/Install our Environment
OK, now that you’ve got the real stuff safe, let’s see what else we can pull. Turn the laptop off and boot Ubuntu or some other Linux distro you like. For external drives you can just plug them into an existing Linux box.
You’ll need free space on a drive that is larger than the full size of the drive
you’re trying to recover, generally.
ddrescue will output a sparse image with
-S (if your FS supports it). For peace of mind, just get enough space. Though,
with the log file you won’t lose any progress if you fill up the target disk
OK, almost ready to actually recover data. Let’s install
ddrescue. On Debian,
the package is
gddrescue, for GNU ddrescue. The package named
Debian actually gives you
dd_rescue, which is an older version. For other
distros, make sure you get the GNU version, not the Kurt Garloff version (more discussion here).
If your distro doesn’t have a
ddrescue package, you can download it here
If you’re looking to run
ddrescue on Windows, you can install it using
Now, make sure your source is unmounted. In the first pass, we’re going to read all of the blocks we can without retrying ones that give us errors.
Start recovering data - Use Case #1
Open up a shell and run this command with root privileges, substituting
/dev/sda for your messed up disk. If you’re not sure, a quick
fdisk -l might
help you figure it out. The process is non-destructive, so worst case, you
backup the wrong drive:
$ ddrescue /dev/sda imagefile logfile
The above will copy all (readable) blocks from
save a log of it’s progress in
logfile. This way, if we need to cancel the
transfer (or it’s interrupted), we won’t lose our progress.
So, that’s all you really have to do. ddrescue is smart enough to do what’s best for your block device in most cases. After going through and copying all that it can without errors, it will go back through and retry anything it had trouble with.
Recover from copies of the damaged block device - Use Case #2
So, this is less common, as I mentioned, but if you do have 2 CDs with
scratches, run the command from Use Case #1 twice. One time on the first CD,
once on the second. Use the same logfile and the same destination file, this way
ddrescue only has to check the second CD for the parts that it could not read
from the first.
$ ddrescue /dev/cdrom imagefile logfile # wait for it to complete # put CD 2 in the drive $ ddrescue /dev/cdrom imagefile logfile
- If you need to recover data from a hard drive you think might be damaged, use
- Make sure you’re using GNU’s
ddrescuedo it’s own thing unless you reall know what you’re doing
- Always use the logfile/mapfile
Note on references
- This is another article that originally came out of my work at UCSB, like the LFTP article elsehwere on this blog.
- The original article references a page on forensicswiki.org
original source of this info. The info on both pages is now out of date.
ddrescuedoesn’t do “splitting” anymore, it does “scraping”. There’s also usually no need to pass specific options as presented in these articles.