10 A small tutorial with examples

This tutorial is for those already able to use the dd command. If you don’t know what dd is, better search the net for some introductory material about dd and GNU ddrescue first.

A failing drive tends to develop more and more errors as time passes. Because of this, you should rescue the data from a drive as soon as you notice the first error. Be diligent because every time a physically damaged drive powers up and is able to output some data, it may be the very last time that it ever will.

You should make a copy of the failing drive with ddrescue, and then try to repair the copy. If your data are really important, use the first copy as a master for a second copy, and try to repair the second copy. If something goes wrong, you have the master intact to try again.

If you are trying to rescue a whole partition, first repair the copy with e2fsck or some other tool appropriate for the type of partition you are trying to rescue, then mount the repaired copy somewhere and try to recover the files in it.

If the drive is so damaged that the file system in the rescued partition can’t be repaired or mounted, you will have to browse the rescued data with an hex editor and extract the desired parts by hand, or use a file recovery tool like photorec.

If the partition table is damaged, you may try to rescue the whole disc, then try to repair the partition table and the partitions on the copy.

If the damaged drive is not listed in /dev, then you cannot rescue it. At least not with ddrescue.

See Copying CD-ROMs and DVDs, for rescue examples of CD-ROMs and DVDs.

Example 1: Fully automatic rescue of a whole disc with two ext2 partitions in /dev/sda to /dev/sdb.
Note: you don’t need to partition /dev/sdb beforehand, but if the partition table on /dev/sda is damaged, you’ll need to recreate it somehow on /dev/sdb.

ddrescue -f -r3 /dev/sda /dev/sdb mapfile
fdisk /dev/sdb
e2fsck -v -f /dev/sdb1
e2fsck -v -f /dev/sdb2

Example 2: Rescue an ext2 partition in /dev/sda2 to /dev/sdb2.
Note: you need to create the partition sdb2 with fdisk first. sdb2 should be of appropriate type and size.

ddrescue -f -n /dev/sda2 /dev/sdb2 mapfile
ddrescue -d -f -r3 /dev/sda2 /dev/sdb2 mapfile
e2fsck -v -f /dev/sdb2
mount -t ext2 -o ro /dev/sdb2 /mnt
  (read rescued files from /mnt)

Example 3: While rescuing the whole drive /dev/sda to /dev/sdb, /dev/sda freezes up at position 12345678.

ddrescue -f /dev/sda /dev/sdb mapfile         # /dev/sda freezes here
  (restart /dev/sda or reboot computer)
  (restart copy at a safe distance from the troubled sector)
ddrescue -f -i 12350000 /dev/sda /dev/sdb mapfile
  (then copy backwards down to the troubled sector)
ddrescue -f -R /dev/sda /dev/sdb mapfile

Example 4: While rescuing the whole drive /dev/sda to /dev/sdb, /dev/sdb fails and you have to rescue the data to a third drive, /dev/sdc.

ddrescue -f -n /dev/sda /dev/sdb mapfile1       # /dev/sdb fails here
ddrescue -f -m mapfile1 /dev/sdb /dev/sdc mapfile2
ddrescue -f -n /dev/sda /dev/sdc mapfile2
ddrescue -d -f -r3 /dev/sda /dev/sdc mapfile2

Example 5: While rescuing a partition in /dev/sda1 to the file hdimage, /dev/sda1 stops responding and begins returning read errors, causing ddrescue to mark the rest of the partition as non-scraped.

ddrescue -n /dev/sda1 hdimage mapfile          # /dev/sda1 fails here
  (restart /dev/sda or reboot computer)
ddrescue -n -A -i<pos> -O /dev/sda1 hdimage mapfile
  (if /dev/sda1 fails again, restart /dev/sda or reboot computer and
   then repeat the above command as many times as needed until it
   succeeds. <pos> is the position where the drive stopped responding)
ddrescue -d -r3 /dev/sda1 hdimage mapfile

Example 6: While rescuing a partition in /dev/sda1 to the file hdimage, sda1 disappears from /dev.

ddrescue -n /dev/sda1 hdimage mapfile          # /dev/sda1 fails here
  (restart /dev/sda or reboot computer and then repeat the above
   command as many times as needed until it succeeds)
ddrescue -d -r3 /dev/sda1 hdimage mapfile

Example 7: While rescuing a partition in /dev/sda1 to the file hdimage, the partition table of /dev/sda becomes unreadable and the OS no longer shows sda1 in /dev. The solution is to shift the mapfile and read the rest of the partition sda1 from /dev/sda.
Note: you need to know the offset of the partition sda1 in the drive sda and the size of sda1.

ddrescue /dev/sda1 hdimage mapfile       # partition table fails here
ddrescuelog --shift -o<offset> mapfile > shifted_mapfile
ddrescue -i<offset> -o0 -s<size> /dev/sda hdimage shifted_mapfile

Example 8: After rescuing a partition in /dev/sda1 to the file hdimage, expand hdimage to copy the whole drive in /dev/sda without recopying the already copied partition /dev/sda1. The solution is to shift the mapfile, move the data of sda1 to its final position in hdimage, and then read the rest of the data from /dev/sda.
Note: you need to know the offset of the partition sda1 in the drive sda and the size of sda1.

ddrescue /dev/sda1 hdimage mapfile             # rescue partition
ddrescuelog --shift -o<offset> mapfile > shifted_mapfile
ddrescue --same-file -o<offset> -s<size> --reverse hdimage hdimage
ddrescue /dev/sda hdimage shifted_mapfile      # rescue rest of drive