Data recovery with the GNU ddrescue utility By Armando Caussade, http://armandocaussade.org/ Version 1. January 31, 2020. Reprinted from the PRLUG newsletter, January 2020. Copyright © 2020 Armando Caussade. Some rights reserved. Creative Commons License BY-NC-ND 4.0. ----- GNU ddrescue is a command-line tool for data recovery on GNU/Linux operating systems (henceforth "Linux"), which was launched by Antonio Díaz Díaz in 2014 and remains in active development. The tool copies data from one file or physical unit (i.e., hard drive, optical disc) to another, trying to rescue the good parts first, and then intelligently attempting to re-read parts that failed to read during the initial pass. The GNU ddrescue program is not to be confused with the "dd" command, which is commonly used on Linux systems to make exact copies of a drive or partition. Moreover, it should not be confused with the "dd_rescue" utility by Kurt Garloff, a similar tool that is also under active development. But it should be noted that GNU ddrescue is newer, and according to some reports it should perhaps be preferred over its predecessor. To install GNU ddrescue on Debian-based distributions of Linux, open a terminal and type the command below. On Ubuntu make sure that the "universe" repository is enabled. $ sudo apt-get install gddrescue The is also a graphical frontend for ddrescue by Hamish McIntyre-Bhatty, known as "DDRescue-GUI". To install the front-end, open a terminal and type the following: $ sudo add-apt-repository ppa:hamishmb/myppa $ sudo apt-get update $ sudo apt-get install ddrescue-gui As a command-line utility, the user will need to learn the proper syntax, in order to effectively use ddrescue. An example of syntax that I have successfully used appears below. $ ddrescue -d -f -r3 /dev/sda /dev/sdb /media/usb/logfile.txt The options mean the following: -d tells ddrescue to use direct disk access and bypass the kernel. -f tells ddrescue to write output to a physical unit instead of a file. -r3 tells ddrescue to retry bad sectors 3 times before giving up; but on a failing drive which could die at any moment, this option should perhaps be ommitted. /dev/sda is the physical unit we are rescuing; a specific partition would be referred to /dev/sda1 instead. /dev/sdb is the name of the new, blank physical unit where the rescued data will be placed; again, a specific partition would be referred to /dev/sda1 instead. /media/usb/logfile.txt is the location of the logfile. GNU ddrescue supports (and recommends) the use of a logfile. A logfile will allow the user to resume an interrupted disk image at the point it left off, or to launch successive passes on bad sectors after a completed initial pass. But bear in mind that the logfile should never be written to the filesystem that is being rescued, but rather to an external filesystem. As explained, I have successfully used GNU ddrescue in the past to rescue data from bad external drives that were otherwise unreadable. Since the utility reads at the lowest possible level, it can work with foreign filesystems like Microsoft NTFS, something that I have successfully tested myself. The results of ddrescue are amazing, but the user should be aware that large drives can take many hours (or even days) to be read with multiple passes. ###