Disk Cloning (for Data Recovery) with GNU ddrescue

techmuck.blogspot.com/2012/03/data-recovery-with-gnu-ddrescue.html
Disclaimer: This article is intended for those of you technically inclined enough to even attempt data
recovery. This involves (minimally) being able to burn a CD, use command-line utilities, and some
hardware knowledge.
Things to Know
If your hard drive is dying (i.e. making weird clicky noises, giving read errors, etc) MAKE A CLONE
COPY OF IT ASAP. The more you use your dying drive, the greater the likelihood of more errors
developing. Copy your data onto a different (not dying) drive and then stop using the bad drive. Always
perform data recovery techniques on a copy of the original drive. If one of the data recovery techniques
fails, it may further scramble your data. Work from a copy. I can't emphasize that enough.
Linux has a very handy tool called ddrescue which can make a clone copy of a disk. It also offers the
option to keep retrying to read the bad areas after the first pass, in hopes that maybe it'll work on the
2nd, 3rd, 4th try, etc.
Things You Will Need
Your bad hard drive.
A working hard drive which has at least as much storage as your bad hard drive.
A way to burn yourself a copy of System Rescue CD (or any other Linux Live CD which
includes ddrescue)
A computer with both (bad and good) drives connected to it.
The Procedure
1. Boot the computer with the System Rescue CD.
2. At the root# prompt type fdisk -l to list all the attached drives.
3. Assuming we're dealing with 2 modern SATA hard disks, likely one will be listed as /dev/sda and
one will be listed as /dev/sdb (this may vary depending on your configuration)
For the purpose of this article, we shall say /dev/sda is the bad drive and /dev/sdb is the
working drive.
4. Clone sda to sdb with ddrescue:
root# ddrescue -r=1 -n -S -v /dev/sda /dev/sdb recovery.log
5. Here's a breakdown of what the command actually does:
1. -r=1 = retry the damaged areas infinite times
2. -n = Skip the splitting pass. Avoids spending a lot of time trying to rescue the most
difficult parts of the file.
3. -S = Sparse mode. May save a lot of disk space in some cases.
4. -v = Verbose mode. Shows all the details about what's happening.
5. /dev/sda = the source drive
6. /dev/sdb = the destination drive
7. recovery.log = The name of the log file. (can be whatever name you want.) In case you
need to stop and restart the process, the log file will keep the spot of where the process
left off.
6. This process can be very slow. Depending on the size of your drive and how badly it's
performing, it can take days. However, if your data is really that important, it's worth it. Patience
is key.
7. Once the drive finishes it's initial pass of copying the good parts of the drive, it will continue to
retry the areas which had errors. Typically by about 4+ passes of the bad areas, it's pretty much
certain you're not going to get any more information from those areas of the drive. Cancel the
ddrescue process via CTRL-C. Store the damaged drive in a static bag. Don't do anything more
with it in case you need to clone it again.
8. Hook up the drive with the copy of the bad disk as a secondary drive on a working computer.
See if you can access the data. There's a number of applications available which will attempt to
repair the drive if it's still unreadable. (Perhaps the File Allocation Table needs to be rebuilt.)
Here is a pretty good list of data recovery software you may want to try on your cloned disk.
Just remember don't run data recovery software on the original drive. It may cause further damage
to the disk and render your data completely unrecoverable. Always work from a copy.