In this post I want to share a very powerful skill that can be used to recover data from a disk that is undergoing physical failures. I will share in another post about how to quickly tell, using SMART reporting, whether computer system issues are Hard Drive related. This is another entry in a group of posts that will focus on using Parted Magic (a bootable utility) to perform various diagnostic and recovery operations.
The great part about this, is that sending a disk for professional recovery can cost hundreds if not thousands of dollars. The method that we will share in this post can be done for a very cost effectively, and if you have a spare Hard Drive, it can be done almost for free (except for the $15 charge to purchase Parted Magic). This method is very safe if done carefully, because no data on the original drive will get lost. Also, a “Recovery Clone” (As I like to call it) is very useful before attempting disk pounding, file system recovery software tools to recover files. A ddrescue recovery, uses a sophisticated algorithm and is extremely patient, when creating a clone onto a healthy drive. It is designed to gently go around failing sectors of the disk and “trim them” later on in the process, so you can get as much usable data in your copy as possible.
It also is very versatile with a myriad of options and also the ability to save your progress, so that if you need to interrupt it for whatever reason (Failing disks especially sometimes, need to be disconnected for a while and then reconnected – in my experience) you can resume from where you were up to. The goal would be to get as much usable data off of the failing disk and then perform file recovery operations on the physically healthy (although very possibly badly corrupted) disk while leaving the original alone.
That’s enough intro for now – Let’s Dig In!
Step 1 – Identify Drives
This step is arguably the single most important step of all. It is crucial not to mix up the source and target drive. If we are not %1000 percent sure of which drive is the one that has the data we need and which one is the destination, we could end up in a disastrous situation where we fully erase the disk we were trying to save.
One tip that I find helpful is to not have any drives attached to the computer that we are working with before beginning. Even the boot media should be removed after Parted Magic loads. If the drive we are recovering is the internal drive of the computer then further action is needed. If we are using another computer to try to restore a drive externally, remove the computer’s internal drive as well. Now connect the drive that we are recovering.
Open a terminal window (The icon looks like a black computer screen with a “$”).
Type the command “lsblk” (No Quotes). This will display the physical disks and logical drives that the system can see. In Linux, disks get labeled sequentially – /dev/sda, /dev/sdb, /dev/sdc etc. Logical partitions (drives) are nested underneath each physical disk also sequentially – /dev/sda1, /dev/sda2, /dev/sda3 etc.
If you all you have is the single disk that we are trying to recover as described above, your output should only include the /dev/sda drives.
Now connect the second drive and type the ‘lsblk’ command again. The output should now show both sda and sdb drives.
Step 2 – Wipe the Destination Drive
If your destination drive is brand new and never been used before, you can skip this step. This step is important if the drive you are recovering to has been used before and contains data. The reason this is important is because very often the source drive is so badly damaged that the recovered partition is too corrupted to read and will require recovery software to use. In this case having the old layer of data will just result in confusion.
WARNING: BE VERY CAREFUL TO BACK UP ANY REQUIRED DATA FROM SDB BEFORE PROCEEDING. ALL DATA WILL BE WIPED.
Open “Erase Disk” from the Desktop.
Select Block Wipe and Disk Write Zeros
Select the disk that we will be wiping (in our example sdb) and accept the warnings.
Perform Recovery Clone
In the terminal type the following command to clone the damaged drive to your healthy drive.
ddrescue -d -f -r 0 -n /dev/sda /dev/sdb logfile
The breakdown of the command is as follows
ddrescue – This is the actual clone command
-d – This calls for direct disk clone which bypasses the kernel cache
-f – This means force overwrite target
-r 0 – This means do not retry failed reads
-n – This means no scrape. This avoids a lengthy step which does not usually produce results in my experience.
logfile – This is extremely important. This means that ddrescue will log progress so that it can be resumed in case of interruption. The next time you run the command with that switch and call the file, it will resume based on the file contents. It is important to copy the file to removable media before powering off the computer so that it can be used again.
You can get more information in the official manual here GNU ddrescue Manual.
Although it can seem a bit intimidating, with the proper care, ddrescue can be a powerful tool to recover a damaged drive.