dd to the rescue

Recently, I needed to rescue a DVD (legally owned!) with read errors by making a copy. In Linux, the “device dump” or dd command can be useful, because it can read past disk errors and thus salvage whatever is intact. For example,

dd if=/dev/sr0 of=rescued_dvd.iso bs=2048 conv=noerror,notrunc iflag=nonblock

tells dd to perform low-level read (blocksize 2048bytes) from the raw device, i.e., /dev/sr0, to write whatever was salvageable to the file “rescued_dvd.iso” and to skip over errors (most importantly, the conv=noerror parameter). Fortunately, I realized that there is something even better, a neat utility called ddrescue. In principle, ddrescue performs the same low-level read, but it is optimized for failing hard drives — and this prompted this post.

I have rescued my share of hard disks, often for colleagues who came to me as a last resort. There are several tricks with which data from a failing hard drive can be recovered — even in cases that seem hopeless. Typically, Windows gives up first, claiming a nonexistent or unformatted disk (hint: don’t accept the offer to format the drive!). Here are some steps that I found useful to follow:

Turn off the computer. Don’t even bother shutting down. The write operation is more critical than the read operation, and any attempt to write to a failing hard disk makes matters worse. And Windows writes a lot to any drive during boot and shutdown.

Attach the drive to a Linux computer. Some computers have a hot-swap e-SATA connector. An external SATA-to-USB cradle is useful, too. Worst case, attach it internally (with power down) and boot it up. DO NOT ALLOW THE O/S MOUNT THE DISK!

A first attempt can be made by mounting the drive read-only (!) and trying to read as many files as possible. Often, 80 to 90% of the data can be recovered in this fashion.

Next, ddrescue comes into play. Since the low-level device is accessed, the drive does not need to be mounted. Let’s assume the drive maps to /dev/sdd. In the simplest form

ddrescue /dev/sdd disk_rescue.img

starts ddrescue and tries to image the entire drive to the file disk_rescue.img. Note that this is a raw read operation, and the image file will be as large as the entire drive capacity. For example, if you image a 1TB hard disk, you need to have 1TB free space — if necessary, use a separate hard disk.

The interesting feature of ddrescue is that it attempts to read good sectors first (to salvage as much as possible, assuming that the drive keeps degrading), then repeatedly reads the bad sectors — often, repeated reads are rewarded with a random success. This process can take days, literally. When the process is finished, mount the image file and examine what you salvaged.

DISCLAIMER: This article is not intended as advice, and the author assumes no warranty, either explicit or implied. If you have critical data, consult a professional data recovery service.



Leave a Reply

Your email address will not be published. Required fields are marked *