This tutorial is for those already able to use the dd command. If you don’t know what dd is, better search the net for some introductory material about dd and GNU ddrescue first.
A failing drive tends to develop more and more errors as time passes. Because of this, you should rescue the data from a drive as soon as you notice the first error. Be diligent because every time a physically damaged drive powers up and is able to output some data, it may be the very last time that it ever will.
You should make a copy of the failing drive with ddrescue, and then try to repair the copy. If your data are really important, use the first copy as a master for a second copy, and try to repair the second copy. If something goes wrong, you have the master intact to try again.
If you are trying to rescue a whole partition, first repair the copy with e2fsck or some other tool appropriate for the type of partition you are trying to rescue, then mount the repaired copy somewhere and try to recover the files in it.
If the drive is so damaged that the file system in the rescued partition can’t be repaired or mounted, you will have to browse the rescued data with an hex editor and extract the desired parts by hand, or use a file recovery tool like photorec.
If the partition table is damaged, you may try to rescue the whole disc, then try to repair the partition table and the partitions on the copy.
If the damaged drive is not listed in /dev, then you cannot rescue it. At least not with ddrescue.
See Copying CD-ROMs and DVDs, for rescue examples of CD-ROMs and DVDs.
Example 1: Fully automatic rescue of a whole disc with two ext2 partitions
in /dev/sda to /dev/sdb.
Note: you don’t need to partition /dev/sdb beforehand, but if the
partition table on /dev/sda is damaged, you’ll need to recreate it
somehow on /dev/sdb.
ddrescue -f -r3 /dev/sda /dev/sdb mapfile fdisk /dev/sdb e2fsck -v -f /dev/sdb1 e2fsck -v -f /dev/sdb2
Example 2: Rescue an ext2 partition in /dev/sda2 to /dev/sdb2.
Note: you need to create the partition sdb2 with fdisk first. sdb2 should be
of appropriate type and size.
ddrescue -f -n /dev/sda2 /dev/sdb2 mapfile ddrescue -d -f -r3 /dev/sda2 /dev/sdb2 mapfile e2fsck -v -f /dev/sdb2 mount -t ext2 -o ro /dev/sdb2 /mnt (read rescued files from /mnt)
Example 3: While rescuing the whole drive /dev/sda to /dev/sdb, /dev/sda freezes up at position 12345678.
ddrescue -f /dev/sda /dev/sdb mapfile # /dev/sda freezes here (restart /dev/sda or reboot computer) (restart copy at a safe distance from the troubled sector) ddrescue -f -i 12350000 /dev/sda /dev/sdb mapfile (then copy backwards down to the troubled sector) ddrescue -f -R /dev/sda /dev/sdb mapfile
Example 4: While rescuing the whole drive /dev/sda to /dev/sdb, /dev/sdb fails and you have to rescue the data to a third drive, /dev/sdc.
ddrescue -f -n /dev/sda /dev/sdb mapfile1 # /dev/sdb fails here ddrescue -f -m mapfile1 /dev/sdb /dev/sdc mapfile2 ddrescue -f -n /dev/sda /dev/sdc mapfile2 ddrescue -d -f -r3 /dev/sda /dev/sdc mapfile2
Example 5: While rescuing a partition in /dev/sda1 to the file hdimage, /dev/sda1 stops responding and begins returning read errors, causing ddrescue to mark the rest of the partition as non-scraped.
ddrescue -n /dev/sda1 hdimage mapfile # /dev/sda1 fails here (restart /dev/sda or reboot computer) ddrescue -n -A -i<pos> -O /dev/sda1 hdimage mapfile (if /dev/sda1 fails again, restart /dev/sda or reboot computer and then repeat the above command as many times as needed until it succeeds. <pos> is the position where the drive stopped responding) ddrescue -d -r3 /dev/sda1 hdimage mapfile
Example 6: While rescuing a partition in /dev/sda1 to the file hdimage, sda1 disappears from /dev.
ddrescue -n /dev/sda1 hdimage mapfile # /dev/sda1 fails here (restart /dev/sda or reboot computer and then repeat the above command as many times as needed until it succeeds) ddrescue -d -r3 /dev/sda1 hdimage mapfile
Example 7: While rescuing a partition in /dev/sda1 to the file
hdimage, the partition table of /dev/sda becomes unreadable
and the OS no longer shows sda1 in /dev. The solution is to shift the
mapfile and read the rest of the partition sda1 from /dev/sda.
Note: you need to know the offset of the partition sda1 in the drive sda and
the size of sda1.
ddrescue /dev/sda1 hdimage mapfile # partition table fails here ddrescuelog --shift -o<offset> mapfile > shifted_mapfile ddrescue -i<offset> -o0 -s<size> /dev/sda hdimage shifted_mapfile
Example 8: After rescuing a partition in /dev/sda1 to the file
hdimage, expand hdimage to copy the whole drive in
/dev/sda without recopying the already copied partition
/dev/sda1. The solution is to shift the mapfile, move the data of
sda1 to its final position in hdimage, and then read the rest of the
data from /dev/sda.
Note: you need to know the offset of the partition sda1 in the drive sda and
the size of sda1.
ddrescue /dev/sda1 hdimage mapfile # rescue partition ddrescuelog --shift -o<offset> mapfile > shifted_mapfile ddrescue --same-file -o<offset> -s<size> --reverse hdimage hdimage ddrescue /dev/sda hdimage shifted_mapfile # rescue rest of drive
Example 9: Recover a collection of photos from a damaged external drive (/dev/sdc1). The photos are protected with forward error correction (fec) files created by lziprecover. The photos are in directory photos, and the fec files are in directory photos-fec.
ddrescue -b4096 -r10 /dev/sdc1 hdimage mapfile mount -o loop,ro hdimage /mnt/hdimage cp -a /mnt/hdimage/photos photos cp -a /mnt/hdimage/photos-fec photos-fec umount /mnt/hdimage lziprecover -v -Fr --fec-file=photos-fec/ photos/* (Check and rename repaired files. They are named photos/*_fixed)
Example 10: Recover a damaged backup with a zeroed sector of 4096 bytes at file position 1019904, using as reference a previous backup. The damaged backup comes from a damaged partition copied with ddrescue.
ddrescue -b4096 -r10 /dev/sdc1 hdimage mapfile mount -o loop,ro hdimage /mnt/hdimage cp /mnt/hdimage/backup.tar.lz backup.tar.lz umount /mnt/hdimage lzip -t backup.tar.lz backup.tar.lz: Decoder error at pos 1020530 lziprecover -vv -e --reference-file=old_backup.tar backup.tar.lz Reproducing bad area in member 1 of 1 (begin = 1019904, size = 4096, value = 0x00) (master mpos = 1019903, dpos = 5857954) warning: old_backup.tar: Partial match found at offset 5743778, len 9546. Reference data may be mixed with other data. Trying level -9 Reproducing position 1015808 Member reproduced successfully. Copy of input file reproduced successfully.