Ddrescue

This page is dedicated to how you can recover from a disaster where your drive just stop working or start being corrupted. This How-To is oriented to the recovery of the content of the drive using ddrescue low level tool. If you are lucky you can stil get some of your data using rsync, but I strongly advise you not to do so. Why ?

• because you might recover corrupted files withotu knowing
• because you might end your drive before you can harvest all what you need by forcing it on the errors instead of getting what is still good and try after what is hopless.

First step: get your backup

Get your backup. Your very last backup. This is your best chance. Yes even if you have a RAID mirror. GO back to your regular backup, and hope it is incremental, so you can get access to few older versions of important files, because it may happen that your drive is corrupt for a long time, and just decide be obvious today by throwing errors or refusing access.

Second step: get new drives

You will need ideally 3 time the space of your failing drive / partition you want to recover. It could be a bigger disk to write the images on it, or it could be 3 other identical or bigger drives. Why that much ?

First one will be for the initial low level copy of the disc. This initial copy is to keep untouched to get back when your data fixes fail at a later step. If you have been lucky enough to harvest 100% or almost of your dying disk, do not believe you will be that lucky a second or a third time. It might totally die before.

Second one is to work on it, This is the disk you will try to do some fsck on it or any other tool that will try to alter (not only read) the data.

Third one is your recovery.

If you are short in space, then you need at least twice the disk size plus the data size to harvest.

fifth step: get and run ddrutility

ddru_findbad sdb1.img sdb1.log

sixth step: try to mount and recover

This step is to make you save time if your files are not in the corrupted list from ddrutility and the partition is able to mount. If not you will be forced to get to next step. Sometime using fsck it makes the partition less workable, this is why it might worth the try to harvest some files before.

sources

• https://www.forensicswiki.org/wiki/Ddrescue#Partition_recovery
• https://unix.stackexchange.com/questions/5226/saving-data-from-a-failing-drive
• https://sourceforge.net/projects/ddrescueview/
• https://sourceforge.net/projects/ddrutility/files/