Return to Level1Techs.com

4tb data recovery ddrescue

Hi Level1Techs
I am trying to recover my data from a 4tb hdd which is about 900 GB of data and now i think most of it is very much not readable but i only have extra 1TB hdd which i think will be enough for my 900GB data in 4tb hdd
After running and trying with different flags, I am getting no response from ddrescue command and it stuck there, Probably i think it recovered 18Gb of data and stuck, Please help me with this.

Some drives (e.g. wd green) have this built in error recovery thing that will reattempt to read the bad stuff forever failing miserably, keeping the drive busy and stuck

What’s the drive type?

One option could be to power cycle it, and skip a couple of hundred megs and see what else you can pull from it.

Check your cables and make sure they are plugged in. If they are fine try a different SATA cable and a different SATA port in that order.

If the problem is indeed with the drive and you are lucky the problem is with the chips or board on the drive. In that case you can get the same exact drive and swap the board on the outside unless it is an SSD. This is the best case scinario with the highest chance for recovery. Some drive create page tables of the data in the drive and in that case it is ideal to determine if that chip is still functional and transfer it to your new board because they can wipe the data or alter it if the page table doesn’t match the data. In data recovery their is always a chance the data can not be recovered.

The best practice is to back up your data on a separate drive or NAS. For up to 4 TB I like an external drive that is not always on or connected to a PC. Less use less ware on the drive.

But before you go tearing your drive apart do research and determine if the board failed or the disk is corrupt or damage. Be extremely careful you require a dustless environment to open the compartment containing your actual platters and you shouldn’t have to do that to determine the point of failure. If you aren’t comfortable with this kind of thing I highly recommend a professional data recovery service. I find it is extremely important to make sure their is airf flow over your drives. Most drives fail due to heat. Positioning your drives in the direct path of a fan is always a good Idea.

Keep in mind as you move forward that continuing to use a damaged drive increases the risk of catastrophic damage to the data and drive. If the data on it is extremely sensitive I would seriously just disconnect the drove and contact an experienced data recovery specialist.

In any case good luck.

Hi,
Yes it is WD my passport but external (USB) drive, can you please tell me some command with ddrescue to help with it and i would like to ask
Q1: Does the recover files will have appropriate names and folders for it or it will be randomly named ?
and
Q2: Does ddrescue copy files or move it, Means if i recover some data can i will be able to recover it using other deeper method?

and please let me know a command, I am not so familiar with it :slight_smile:

that is beautiful info, But my drive is external and both are external (USB) the original with 4TB in size and 900GB of data and the destination with 1tb of space and total in size.

Is the bad drive USB on the actual PCB board of the drive or it is in some kind of enclosure that it adapting USB to SATA?

Sorry for not clearing it that much (i don’t know that much)

It’s this thing

USB to USB connection, I am using it in USB 2.0 port.
and since i might opened the board a time ago but don’t remember if usb to sata is happening with board or not.

change -r3 to -r0 as you likely dont have time to go through the whole drive endlessly retrying 3 times on each bad sector. Also use -n for no scrape.

What was the output of your smart info?

USB3 would be ideal here.

Thanks for post, I do have a usb3.0 laptop but it doesn’t have ubuntu in it, Or it is so loaded with work that i can’t risk damaging original window in it :slightly_smiling_face:

I already tried with -n and -r1 but almost same result, Worked for like an hour or so with 7mb/s and then above output.

I will try with -r0 by tomorrow.

the point of -r0 is to just copy what it can read and skip the rest. You can then go back later with -r3 to try to get through the rest but thats not likely to yield much.

Also to answer some other questions and reduce confusion.

ddrescue is low level like dd is, so you can expect files that it can read to be exactly how they are. ddrescue is working with the raw data on the disk as opposed to individual files.

The resulting image that ddrescue creates could in theory be written out to a disk.

since we’re coping the disk at a lower level than the filesystem, you can expect to go back with other tools later and extract data assuming theres data to extract. In some cases this wont work because there just isnt any data to extract or the data is corrupt.

testdisk and photorec are going to be your friends.

1 Like

It is a good possibility that the USB controller on the drive is failing. Just take it out of the enclosure and connect it to the motherboard and pray the bad controller hasn’t taken out any of your data.

USB drives dont like to be constantly connected or lard continuous data transfers over long periods of time. They tend to overheat and die. Also a USB enclosure with a fan might help with large data and long duration connections.

NVME on USB-C tends to work better for that sort of thing because its basically a PCI-E connect…

Odds are extremely likely the data on the disc is transparently encrypted. Taking it out of the enclosure would yield nothing useful.

Hi guys, Merry Christmas
I read that it is important to clone the drive first before recovery, I am doing it with 1TB HDD and the img file size in it showing 4TB while the data in 4tb is only around 900GB, I can understand byte to byte copy but am i doing right ? and when i stopped ddrescue and tried opening img file with 7zip or simple window mount then it shows it is corrupted, So unable to extract it. So please tell me am i doing right ? with my current explanation and should i wait for ddrescue to complete the procedure and then can i file RMA to send drive back ?

I tried with testdisk on windows before but have to stop it because it took the day and recovered random labeled data around 6GB.

in this video Data Recovery Tutorial - Getting started with DDRescue and TestDisk Wendell somewhere says there are 200% (like more powerful) tools, what are those? and are they helpful in my scenario ?

theres some other things out there but for this situation, this is really what you need to use.

If you are going to clone the drive I would use the disk utility or third party utility like EaseUS or partition wizard.

How ever clonig almost a TB of data off of a USB drive will probably fail and kill the controller on the enclosure in the process. This has happened to me many times with USB hardrives and just trying to copy their full content of non corrupt data off of them all at one time. I seriously recommend removing the drive from the enclosure and connecting it directly to your motherboard. Then test to see if the data is still showing as corrupt and if so or even if not so clone it.

If the external enclosures controller fails and locks up reading the disk continuously it can damage the drive. It could also eroniously purge or insert data during failure. If data is altered recovering the origional data could be even more difficult to impossible…

Your problem of slow recovery and corrupt looking random data recovery could easily be a bad or overheating enclosure controller.

If you remove the drive and recover your data successfully or at all and RMA it and they say anything about it the fact that your were successful in recovering the data proves the enclosure failed. And depending how sensitive your data is you may wish to wipe the drive any ways… Not sure what they do with RMA drives…

1 Like

Encrypted or not I have lost many drives and enclosures hitting them hard enough to run a clone or recovery on 100gb or more… Some times even 50gb. Most enclosures are nit meant to be hit that hard and will fail in my experience. And often times they take your data with them because they lock up reading or writing for example… If I must copy a drive or a lot of data I just remove the drive by default. I have a Vantec hard drive dock I use. It basically just passes the drive through directly to the OS no BS. It works great and I never had a problem with it. How ever for 900gb of data I would still plug the drive into the motherboard as using anything but the latest USB protocol or eSATA would take a very long time and unecisarily stress the drive increasing the chance of failure on an already suspect drive.

Maybe you didn’t quite understand what I was saying. If he takes that drive out, there won’t be any usable data because the encryption happens at the enclosure level, not the OS level. To him the drive is not encrypted at all but WD in their infinite wisdom decided to encrypt it so you can’t just pull the enclosure and get the data off the drive.

https://www.disktuna.com/why-youll-never-see-me-buy-a-wd-my-passport/

Anyway, I’ll leave you guys to figure it out. Good luck.

1 Like