DDRescue - Dead Drive Saver

[Melbosa]

So with Thorin's success with this one a while back, thought I would post a sticky so we can all remember it: http://forums.righteouswrath.com/index.php/topic,7744.0.html

LiveCD Distros:

• http://ubuntu-rescue-remix.org/
• http://www.forensicbootcd.com/
• http://partedmagic.com/
• http://www.sysresccd.org/
• Knoppix, Ubuntu LiveCDs

Instructional Uses:

Legend:
XXX = name of the complete source disk (NOT the partition.)
YYY = name of the complete target disk (NOT the partition.)
ZZZ = name of the mount point of a disk or a USB key to contain the file 'log' activities ddrescue (not required for dd).

AAAA = 4-digit year.
MM = month on two day.
JJ = 2 digit day.
HH = Hour.
MM = Minutes.

The option -B is to force the expression of numbers using powers binary (1024 instead of 1000 for Kbytes, etc ...)
The -v option is to force ddrescue to be "wordy"(we know about what happens) - verbose
The -n parameter does not stress when encountering a bad sector - log and skip bad sector

1 - To recover quickly:

Code Select Expand

ddrescue -B -v -n /dev/XXX /dev/YYY /ZZZ/ddrescue_logfile_AAAA-MM-JJ-HHMM.log

2 - Do another pass to try to recover the non-read the first pass. Needless course in the absence of bad sectors:

Code Select Expand

ddrescue -B -v -c 16 -r 2  /dev/XXX /dev/YYY /ZZZ/ddrescue_logfile_AAAA-MM-JJ-HHMM.log
Be careful to indicate the same .log file, since it is from there that will identify areas to recover. 16 sectors are treated at once (c-16) and retries is 2 (-r 2).

3 - If needed redo a third passage:

Code Select Expand

ddrescue -B -v -c 1 -r 5 /dev/XXX /dev/YYY /ZZZ/ddrescue_logfile_AAAA-MM-JJ-HHMM.log
This time, it does only one sector at a time (-c 1) and the emphasis is heavily (5 retries: r-5).


If you used any other combinations of the above, post them here.

[Thorin]

I hope this doesn't mean that you have a sick computer?

Also, LEAVE IT RUNNING, even if it doesn't seem to be doing anything.  My disk recovery took three weeks with a bad controller board, but _eventually_ every single sector was spared (yay!).  Also, you can go from a smaller to a larger disk but not the other way around.

[Melbosa]

Also, you can go from a smaller to a larger disk but not the other way around.

Hmmm cause it does a complete sector by sector, block by block move?  Or are you talking just data size?

[Lazybones]

Also, you can go from a smaller to a larger disk but not the other way around.

Hmmm cause it does a complete sector by sector, block by block move?  Or are you talking just data size?

Correct, when you are doing sector copies everything has to line up or the filesystem will not make any sense... Some commercial packages have an extra step that allows shrinking partitions on SOME file systems by remapping everything but it isn't a common feature. Small to large is the general rule.

[Melbosa]

Yeah I figured as much.  Well I'm hoping the one I have to run this on has the spare space at the end of the drive, and I don't have a larger or equivalent drive handy.  Good news is that this was freshly imaged from an HP restore, so I hope it really is only all at the beginning of the drive.

[Tom]

ddrescue/dd_rescue is quite nice. I also like using Clonezilla, in particular partclone and partimage (ntfsclone is good too). The nice thing about part* is that it'll make a compressed clone of your filesystem (not a block by block image) over the network as well as to local disks.

[Thorin]

Yeah I figured as much.  Well I'm hoping the one I have to run this on has the spare space at the end of the drive, and I don't have a larger or equivalent drive handy.  Good news is that this was freshly imaged from an HP restore, so I hope it really is only all at the beginning of the drive.

I suggest you go buy an equivalent or larger drive.  I have no idea what ddrescue will do with less space, but I doubt that it will selectively remove blocks or sectors, as those _might_ contain data.

[Melbosa]

Yeah the data is already safe... so I can play.

[Lazybones]

Yeah I figured as much.  Well I'm hoping the one I have to run this on has the spare space at the end of the drive, and I don't have a larger or equivalent drive handy.  Good news is that this was freshly imaged from an HP restore, so I hope it really is only all at the beginning of the drive.

I suggest you go buy an equivalent or larger drive.  I have no idea what ddrescue will do with less space, but I doubt that it will selectively remove blocks or sectors, as those _might_ contain data.

The point is you CAN'T selectively remove stuff without knowledge of the filesystem, removing even blank space at the end wrecks the consistency of the volume.. That is the catch with block level copy, it basically works with ANY filesystem but it has to be an exact copy or your volume will not boot or will be corrupt.

[Melbosa]

Ahh yes, unless you remap the volume partitions , and fix up the MBR.  I will try and let you guys know how it goes. I really don't have another drive to try this with and the client won't spend any more money on the system.  Again I don't need this thing to boot into a working OS... just need that damn HP Image partition to come across, which will be at the beginning of the drive (accroding to my HP tech reps through work anyway).

[Thorin]

What size of drive?

[Melbosa]

Going from a 500GB to a 300GB, with only 35GBs of data *including the HP Image stuff at 13GB.

[Tom]

Better hope NTFS didn't decide to store anything important near the middle-end or end of the disk. I've seen NTFS put parts of the MTF and other housekeeping stuff near the end or middle-end of the disk.

[Mr. Analog]

For 35 GB of data I'm pretty sure aberrance will be small, if any.

[Melbosa]

True but those things are rebuildable with the tools out there.  Again I'll let you guys know how I make out.  I have little choice at this point.