Recover Data From a dead hard drive using ddrescue
Posted by Admin on October 24th, 2006
If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!
dd_rescue Advantages
Imagine, one of your partitions is crashed, and as there are some hard errors, you don’t want to write to this hard disk any more. Just getting all the data off it and retiring it seems to be suitable. However, you can’t access the files, as the file system is damaged.
Now, you want to copy the whole partition into a file. You burn it on CD-Rom, just to never lose it again. You can setup a loop device, and repair (fsck) it and hopefully are able to mount it.
Copying this partition with normal Un*x tools like cat or dd will fail, as those tools abort on error. dd_rescue instead will try to read and if it fails, it will go on with the next sectors. The output file naturally will have holes in it, of course. You can write a log file, to see, where all these errors are located.
The data rate drops very low, when errors are encountered. If you interrupt the process of copying, you don’t lose anything. You can just continue at any position later. The output file will just be filled in further and not truncated as with other Un*x tools.
If you have one spot of bad sectors within the partition, it might be a good idea, to approach this spot from both sides. Reverse direction copy is your friend.
The two block sizes are a performance optimization. Large block sizes result in superior performance, but in case of errors, you want to try to salvage every single sector. So hardbs is best be set to the hardware sector size (most often 512 bytes) and softbs to a large value, such as the default 16k.
Install dd_rescue in Debian
Install ddrescue using the following command
#apt-get install ddrescue
Install ddrescue in Ubuntu
sudo apt-get install ddrescue
This will complete the installation
ddrescue Syntax
dd_rescue [options] infile outfile
Now we will see how to use ddrescue under damaged disk
If you have a damaged hard disk /dev/sda1 and you have an empty space hard disk /dev/sda2 Now if you want to copy data from /dev/sda1 to /dev/sda2 use the following commnd
# dd_rescue /dev/sda1 /dev/sda2/backup.img
If you are using ubuntu linux use the following command
sudo dd_rescue /dev/sda1 /dev/sda2/backup.img
This copies an image of /dev/sda1 to sda2
Now you need to check the backup image consistency this will check for is there any problems with this image.
#fsck -y /dev/sda2/backup.img
If you are using ubuntu linux use the following command
sudo fsck -y /dev/sda2/backup.img
After finishing this checking you need to mount your disk image in to your other hard disk
#mount /dev/sda2/backup.img /mnt/recoverydata
If you are using ubuntu linux use the following command
sudo mount /dev/sda2/backup.img /mnt/recoverydata
This will mount all the data from the backup.img under /mnt/recoverydata now you can try to access the data it should work without any problem.
Restore image
If you want to restore this image use the following command
#dd_rescue /dev/sda2/backup.img /dev/sda1
If you are using ubuntu linux use the following command
sudo dd_rescue /dev/sda2/backup.img /dev/sda1
Copy Disk Image to remote machine using SSH
If you want to copy your disk image to remote machine over ssh you need to use the following command
#dd_rescue /dev/sda1 – | ssh username@machineip ‘cat /datarecovery/backup.img’
If you are using ubuntu linux use the following command
sudo dd_rescue /dev/sda1 – | ssh username@machineip ‘cat /datarecovery/backup.img’
This will be prompetd for password of the username you have menctioned in the above command after entering the password dd_rescue strats copying obviously it will take some time to copy over the network.
Possible Error
If you see the following error at the time of copying you can ignore this error
dd_rescue: (warning): output file is not seekable!
dd_rescue: (warning): Illegal seek
If you want to take this image in compressed format you can use the following command format
#tar zcvf – /dev/sda1 | ssh username@machineip ‘cat@@>/tmp /datarecovery/backup.tar.gz’
If you are using ubuntu linux use the following command
sudo tar zcvf – /dev/sda1 | ssh username@machineip ‘cat@@>/tmp /datarecovery/backup.tar.gz’
If you want to know more available options check dd_rescue man page
October 28th, 2006 at 8:49 pm
Actually, dd can do most of what you claim dd_rescue to do with the proper options.
The only feature dd_rescue offers that dd does not is reverse copying, which is kind of moot anyway if either can keep copying while being error tolerant.
November 1st, 2006 at 5:03 am
reverse copy is good because some drives will take days/weeks to copy if you let dd go on thru with conv=noerror,sync because it will try each block and the drive could take 30 seconds to fail a bad sector sometimes. if there is just a terrible band somewhere on the drive which is often then you can copy once normally until it starts going terribly slow and once in reverse until it does again and then you have 90% of the drive with a band missing in the middle and sometimes that is still a useful win depending on the situation and considering the other 10% could take days to get and would be swiss cheese anyways
November 2nd, 2006 at 5:03 pm
Hi guys, i need to recover some valuable data and
family pics from a drive that has gone south. It
was a master on another machine. I changed it(with
jumpers) to a slave so I could access it from
our main puter. When I can see finally see it in
“My Computer”, it gives me a “drive needs formatting”
message. I downloaded DDRESCUE but have no idea
how to use it. It is, I’m sure, way beyond my
technical prowess. I cannot even understand the
instructions provided. Am I in way over my head?
thanks, neo
November 3rd, 2006 at 3:38 pm
Neo, you may be over your head, but if you can read, you can do it. Get yourself a new drive. Install the new drive and set to master, set the old drive to slave. Have someone get you a copy of Ubuntu or Kubuntu (which I prefer). Install it to your new drive. Leave yourself some space, meaning partition your drive, leaving some space to restore your files. The new drive will probably be 200-250 GB. Leave enough room at beginning of the drive to reinstall Windows if you want, like 20GB or so, then make a 1GB swap partition for Linux, then a “/” or root partition of 10-20GB, then make the rest of the drive “/home” or part of it “/home” and room for another NTFS data partition. Decide this scheme ahead of time.
If you want to recover the old drive to CD, then you need a burner before you start, but you will have enough space on your tasty new drive. After you get Linux installed, then you can open a terminal window and run the commands above.
If you can install Linux, then you can do this. If you can’t, then go find your nearest Linux User Group and ask for help. If you are of the mindset that you only use Windows, then good luck finding help. I charge $75/hour for this kind of headache, others charge way more. It gets less and less attractive to work on Windows on the side. If you aren’t willing to learn a bit to solve your problem, then your pictures, etc. must not be that important to you.
November 4th, 2006 at 1:16 am
Actually, there are two programs with similar names, ‘dd_rescue’ and ‘ddrescue’ (my preference)……The difference is ‘ddrescue’ is also known as gnu ddrescue, which can automate the whole process by specifying the log file option, and can resume where it left off if interrupted…….dd_rescue requires a separate wrapper script to automate it…
So you should make sure to use the correct name throughout the entire article, and not interchange dd_rescue with ddrescue….
November 9th, 2006 at 8:28 pm
A guy calls himself Neo and he doesn’t know the difference between Windows and Linux software?
November 9th, 2006 at 8:46 pm
Just one small typo, I noticed.
Under the Install for Ubuntu, you have:
sudo apt-get install ddrescure
but it should be
sudo apt-get install ddrescue
not, a big deal, but I did a copy/paste and could not find the package at first.
November 9th, 2006 at 9:47 pm
thank you very much john i have corrected that
November 29th, 2006 at 4:20 pm
I am surprised you didn’t write about dd_rhelp. dd_rhelp is a wrapper script that makes dd_rescue go back over bad sections, and try to recover data over and over again. By running dd_rescue with dd_rhelp for about three weeks, I was able to recover over 90% of the data on a malfunctioning drive. Without dd_rhelp, I probably would have recovered less than 10% on this particular drive. thegeekster wrote that there are two separate programs with similar names. I am definitely referring to the one with the underscore in the name. What is the difference?
November 29th, 2006 at 6:07 pm
ddrescue is wonderful tool, I rescued data from several disks with its help. But I met a situation several weeks ago when ddrescue failed. Well, ddrescue did good job but result was useless. 20GB disk with 10GB Linux partition was damaged at the place where Linux partition started. I recovered almost everything, only about 100MB (I don’t remember exact number) of disk sectors were unreadable. As the beginning of Linux partition was demaged, I was unable to get data from rescued disk, I was unable to mount rescued partition…
Is there a tool do this job? To recover Linux partition (probably ext2) when partition start is missing?
December 26th, 2006 at 6:51 am
i want this software
December 26th, 2006 at 6:58 am
Hi Rakesh,
you can download this software from this link http://www.gnu.org/software/ddrescue/ddrescue.html
February 3rd, 2007 at 9:56 am
Rakesh,
Here’s a better link:
http://freshmeat.net/search/?q=ddrescue
(That link finds both ddrescue and dd_rescue.)
The program described in this article is Garloff’s original dd_rescue.
The program which I very much prefer is Diaz’s newer GNU ddrescue.
Both are mature, well-respected tools. However, Diaz’s ddrescue maintains a logfile so that it always knows what has been recovered, and what has not. So if you stop it (or your computer crashes) in the middle of a recovery operation, you can just run it again and it’ll pick up where it left off.
Also, you can try again with different options (e.g., after disabling readahead or dma on the drive, or reading smaller chunks), or you can retry while reading from a raw device bound to the /dev/hdx instead of to the drive itself, to read individual sectors. It just works: if you put the drive in the freezer overnight, then hook it up and re-run GNU ddrescue with “-r 1″ (retry bad sectors 1 time), it’ll only try to read the unrecovered sectors, and won’t waste time re-reading the parts that have already been recovered.
What’s more, the logfile is plain ASCII and well-documented, so it serves as a record that you can use for other purposes. E.g., I’ve written a Perl script which reads the ddrescue logfile and spits out a Windows .bat file of ‘nfi’ commands, to determine which files on an NTFS file system are damaged.
-Dave Burton
February 13th, 2007 at 3:25 pm
Hi guys, I need to recover some valuable data.
My hard drive crashed. It doesn’t spin and gives
the error ” Primary hard disk drive 0 not found,
No bootable device-Strike F1 to retry boot,
F2 for setup utility. Please, any help.. Thanks
February 15th, 2007 at 9:15 am
Like Dave Burton says above, ddrescue is actually equivalent to dd_rescue+dd_rhelp+some more. Have a look here under the heading “Disk drive recovery: ddrescue, dd_rescue, dd_rhelp” for a synopsis.
February 28th, 2007 at 5:15 pm
Can somebody please clarify me the first section of the example? My questions:
1. I think /dev/sda1 and /dev/sda2 are two partitions of the same hard disk. If you want to save a backup of the crashed sda1, you shouldn’t place it onto the same physical disk.
2. /dev/sda2 is a device file, so the “/dev/sda2/backup.img” reference is invalid. You should mount the partition first, and then – if it has a writeable filesystem on it – you can create the backup file (the next example assumes that neither sda1 nor sda2 is mounted):
# mkdir /root/rescue
# mount /dev/sda2 /root/rescue
# dd_rescue /dev/sda1 /root/rescue/backup.img
3. I think when you try to mount a regular file as a partition you can only do it through a kernel loop device. It goes like this:
# mount -o loop /root/rescue/backup.img
Sorry if I misunderstood it all.
March 12th, 2007 at 5:36 am
Hi,
Can anyone please tell me whether we can retrieve data from a hard disk after
formatting the hard disk
March 14th, 2007 at 3:06 am
PC trys to log on but states internal disk drive not found; HDD hard error. Then strike F1 to reboot, nothing.
Can someone please let me know what this means, I’m stationed in Afghanistan right know and I’m in need of my laptop right now??
March 22nd, 2007 at 3:38 pm
Hi
Thanks to all for helping; I have a Toshiba drive 40 GB (OEM from an IBM laptop) that went bad on me.
I have some data that I would like to recover from the drive. I have a machine running SUSE Linux 10.1, and inserted the drive in an external 2.5″ enclosure. I installed dd_rescue on the Linux box.
When I run dmesg, I get a lot of I/O Errors with bad logical blocks 1 through 7, and an error message that it is unable to read the partition table.
There are also a lot of bad sectors (too many to list).
When I run: # dd_rescue /dev/sdb /root/backup.img …. dd_rescue runs and seems to give errors for each sector read – no data is recovered, the backup.img is 0 bytes.
I get the same if I run dd_rescue in reverse direction (-r) switch. I let dd_rescue run for about 5 minutes each time, and I ctrl+c to exit as I’m fearful of enacting more damage to the drive.
I have tried these commands with another drive, and the process works, so I’m sure it’s the drive, and not the syntax or the external enclosure.
Any suggestions or tips? Should I send the drive to a professional recovery? They are asking about 1100 to recover data… ooof!
Thanks to any that help!
Brian
April 23rd, 2007 at 4:59 am
dear,
i have a hard drive WD 3GB, but it doesn’t work and not found on system, there is message error
while bios trying to detected the hard drive. i have some data that’s so important for me, and
i want it backed. would somebody want to help me? please….!
April 30th, 2007 at 11:48 am
dead harddrive I want all the technical way to let
it function well.
harddrive can’t boot from the board. cant i do adjustmant on the circut board to let it function well on the jumper
2. power led board work but the cable can’t work what to do.
April 3rd, 2008 at 4:48 pm
i need tutorials on how to recover data from hard drive,os
June 4th, 2008 at 7:56 am
@rido and festus
did you guys read the article and the comments?
June 26th, 2008 at 10:58 am
this is excellent.
November 19th, 2008 at 6:33 am
Hello Friends,
Please Help me…. i am having a laptop and my laptop hard drive is not working. my hard drive is crashed. can anyone help me and tell me how can i recover data from my crashed hard drive to working hard drive..
Thanks
Aman
November 30th, 2008 at 11:15 pm
I have a dead sata harddrive, that is it runs but for some reason it wouldn’t reload windows or recover my info.Anyway i put a new one in my laptop and was wondering is there anyway to get some info from that drive.
January 4th, 2009 at 3:00 pm
There’s a nice livecd out there for recovering bad hard disks:
http://ubuntu-rescue-remix.org/
BTW nobody responded to comment #16 which I thought brought up some relevant mistakes, unless I am misunderstanding too.
January 23rd, 2009 at 11:46 am
Hi,
It appears that folks are not considering simple loose wires etc.. viz… hardware issues.
If the drive is not physically operable in the computer it is in, a good solution is to take it out, put it in an external case with a USB connection and see if it can be “viewed” from a different Linux computer. Occasionally hardware problems may exist between the drive and the rest of the contraption and all such failures qualify as a “hard drive had crashed !” Cases for hardware can be had for as little as US$10 or even cheaper.
good luck
Hopi
April 3rd, 2009 at 12:32 pm
Hi, I have a Sata Intrnal hard drive and it is not detecting in any system.. i also tried by changing the jumper settings, nut its not wrkin.. hw can i retrieve Data frm tat hard Disk Completely.
Ps Help.
June 29th, 2009 at 3:53 pm
I’m using Ubuntu 9.04 ATM, and I noticed that ddrescue is in a package baller gddrescue. I wish it was included in livd CD… (now I have to edit apt sources, update and install it)
June 29th, 2009 at 3:56 pm
Oh! Jack, you are absolutely right in comment #16. And still they have not been corrected!
July 11th, 2009 at 6:34 am
Hi,
Any suggestions on what to use if Linux tries but is not able to make the drive available as a device? I am looking at the system log under Suse Linux and it reports that it found the drive, but could not set the drive up under /dev/sdd. It reports “Unit not ready”, “Sense Key: Aborted Command [current]“….there is more.
Any suggestions to get it recognized as a device so I can run dd_rescue?
Thanks,
Darren
July 14th, 2009 at 11:32 am
please i need help.i usually put my laptop hard drive in an external hard drive enclosure box couse i use it at work unfortunately i dropped it an now its not working even on the external device please can u tell me how to recover the data from at
November 6th, 2009 at 11:14 am
Basically I want to say to those having dropped their harddisks, cant get the disk to start up, etc. You are out of luck. You can take it to a professional forensic recovery company, they can open it up in a dust-free vacuum chamber and transfer your platters to a platter reader. This will probably cost you thousands upon thousands of dollars. So if you are losing those all-important documents/music/emails/baby pictures/OTHER, consider it lost and start fresh. Sometimes it feels good to have a clean slate.