DDRescue on a drive that won't mount

Hardware HDD's & SSD's
1

Hello! I'm new here so forgive me if I posted to the wrong subforum, did not give enough information or gave too much. Also, I know very little about Linux, Ubuntu and all that stuff. Anyways...

On another forum I was advised to use DDRescue to recover data off my dying drive. I quickly realized that it was a Linux tool. So I transferred the drive to my Ubuntu machine. On windows I could access the drive but it would stop responding after about 30 seconds and become un-initialized(I would have to replug the sata on the motherboard and it might come back. On my Ubuntu it isn't even mounting. So as far as I can tell, I cant use DDRescue on it. Any suggestions? If you need more information I will get it to you asap. Thanks

1 Like
2

Do you have a working drive that is the same size or larger than the failing drive?

ideally you'd use ddrescue to clone the drive to another disk (that isn't failing) or a disk image.
you can use gnome-disk-utility to find out which drive is which ( /dev/sda for example)

once you've identified your disks the syntax is pretty simple

sudo gddrescue if=/dev/failingdrive of=/dev/destinationdrive_or_imagefile

i cant remember the options off hand but there area few that can show previews/status/etc, may wanna look into those, but the above will get things going.

If the drive keeps dropping in the middle of copying/cloning you may have a bit more luck with safecopy (it can use low level ata commands to keep poking the drive and resetting it if it drops) I've had safecopy work in instances where dd/ddrescue/dcfldd failed. The big downside to safecopy is on really bad drives it can take a long ass time. syntax is somewhat similar sudo safecopy --stage1 /path/to/failingdrive /path/to/output.
There are three different stages safecopy can go through to attempt to scrape data off the drive, each being more time consuming than the previous .

Once you have a dump/clone of the drive you can use testdisk to repair the partition and attempt to mount it (or loopback mount it if you made a disk image instead of cloning to a raw drive). gparted may also be able to attempt data rescue (its in the menu). if one fails, try the other.

things are in too bad of shape and testisk/gparted aren't able to get you a workable filesystem
you can try the other half of testdisk called photorec to do raw file recovery.

Photorec is sort of a last result as it doesn't recover structure, you'll just have a folder full of enumerated files (enumerated in the order in which they were discovered on the disk)
It may be annoying to have to sort through it all, but there are scripts on the testdisk website (below) that will sort the files by extension. For sorting/renaming your mp3's theres a program called picard (should be in the ubuntu repos) that can examine your audio files and determine what they are and tag/rename them as needed.
I'm sure there are tools for pictures that could do something similar by metadata/camer info/ etc.

Best of luck!

btw, safecopy, ddrescue (gddrescue), and testdisk (includes photorec) are all in the default ubuntu repos, so a simple apt-get install will get them for you.

BUT

If you're running an older release (14.04 or an older version of mint) it may be worthwhile to get the newer binaries from http://www.cgsecurity.org/wiki/TestDisk as the older versions in the repos tend to not work well with gpt disks.

2 Likes
3

I have been watching security now recently and Steve seems to be switched on. He has a drive tool and I have never tested or used it but I believe it is free for users to try out. May help

https://www.grc.com/spinrite.htm

I would be interested in if it works or not. I just dont have a dead drive.

4

I am getting a drive to replace it. But right now I only have a 500gb boot drive. I thought because the dead drive has only about 300gb of the 1tb, I could get away with making an image of the drive and then use it on my new drive when I get it. Would it be best to wait till I actually get my new drive and copy it then?

I'm still not sure how to identify the disk. In /dev/ there isn't any representation of the disk, as far as I can see. As said earlier, I am very new to Linux and Ubuntu so you might have to spoon feed it to me.

5

It does not seem like it is free as the only option I see is to buy it.

1 Like
6

Sorry I thought it had a trial. Ive never needed it.

7

Going to be using ddrescue for this. Could be called ddrescue or gddrescue to install it from your distros repo. This is not dd_rescue, do not use dd_rescue.

From a fresh boot of your Linux system, in a terminal 'fdisk -l | grep sd'
Should get /dev/sda and if you have more drives /dev/sdb, /dev/sdc and so on. Take note of what you have.

Plug in the bad drive and run 'fdisk -l | grep sd' again, you should see the drive /dev/sde or whatever was next from the first results. Take note of the device. You can also run 'dmesg | tail'

Now plug in the known good drive you're going to clone to, and repeat above noting the device just added.

Do not use spinrite to recover from a physically failing drive, you can't fix a physiacally failing drive with software. If the filesystem is hosed, then spinrite might be ok.

The goal is to get the data off the failing drive asap, then monkey with the bad drive to your hearts content.

The ddrescue command to use goes like this, and if there are errors when the first pass finishes, run the 2nd and 3rd pass commands I'm giving you to get more data.

The first pass gets as much data off as possible without stressing the drive. The 2nd pass tries again but retries the error once. The 3rd and final pass will recover in reverse.
Assuming /dev/sdb is the bad drive and /dev/sdc is the good drive only for this example, your devices may be different. You need the Recovery.log in the command for the other 2 passes and also in case the recovery for whatever reason gets interrupted. Repeat the command and the recovery will resume. Without Recovery.log you risk the recovery.

Pay attention to which drives you're using and run them as root or use sudo
1 Example - ddrescue -vvf -n -d /dev/baddrive /dev/gooddrive Recovery.log
ddrescue -vvf -n -d /dev/sdb /dev/sdc Recovery.log

2 Example - ddrescue -vvf -r1 /dev/baddrive /dev/gooddrive Recovery.log
ddrescue -vvf -r1 /dev/sdb /dev/sdc Recovery.log

3 Example - ddrescue -vvf -R /dev/baddrive /dev/gooddrive Recovery.log
ddrescue -vvf -R /dev/sdb /dev/sdc Recovery.log

If you value the data, quit plugging the bad drive into Windows boxes.

Good luck

1 Like
8

spinrite was good back in thee day. After drives got larger than 500GB you have to do a ton of crap to get it to work.

If you are on Linux, get testdisk and photorec or you can use old fashion dd

I recommend photorec because it can recover files and place them in a partition that is currently mounted. dd will clone the drive but if the drive has bad sectors you could be carrying that over in some rare situations. If you hear clicking the drive could be failing, and cant read past certain sectors. Maybe running badblocks to check for any issues could be helpful...

9

gnome-disk-utility is a graphical tool that should ship with ubuntu. It's handy for quick identifcation of drive mappings. Also, it shows serial numbers, so if you've got multiple drives that are the same model you can id them by SN. I think it shows up in the menus as "Disks"

disk_identification.png800x700 73.7 KB

Serial number blanked for paranoia reasons.

I thought because the dead drive has only about 300gb of the 1tb, I could get away with making an image of the drive and then use it on my new drive when I get it.

not necessarily, if a large file was written to the drive that put the the drive past the 300gb range but then later deleted, its possible that some of the files written to the drive after that large file but prior to it being deleted would be outside of the 300gb range on the disk.

Would it be best to wait till I actually get my new drive and copy it then?

IMO: yes.
if time is an issue attempting to cut it off at the 300gb mark may work, but it could only get part of your stuff back.

10

Thank you so much. That was very helpful. One thing, i have my new drive but my PSU only has 2 sata connectors. I know this sounds dumb but can I connect the new drive via a usb 2 connection and it'll work fine albiet slower? It shows up as sdc so i guess ubuntu sees it fine. Thanks

11

The copy was successful according to ddrescue. Now in disks, the new drive shows up but Partition 1 is Unknown and doesn't show up in files.

12

Ok. So I had to make the file system fat for it to be seen and mounted. is that a bad idea? I'm going to do another run off ddrescue. Question: In disks, it refers to the drives as /dev/sdb1 and /dev/sdc1. Do I need to put that 1 in the ddrescue command?
Sorry for the quick burst of replies, I know its bad forum etiquitte

13

the way that's broken down is basically sd is the device type (serial disk i think) a = first disk b = second disk and then the number is the partition
so /dev/sdb2 would be the second partition on the second hard disk, dev sda5 would be the fifth partition on the first drive.

so no, the 1 is not needed. You want to copy the entire disk, not just the partition.

14

Thanks for the clarification

15

Sorry I wasn't receiving notifications.
As d0rk replied, you want the entire disk.

You can also create an image from a partition:
ddrescue -vvf -n -d /dev/sdb1 /path/to/recoverd.img Recovery.log

DMDE is another great app to recover drives. It's available for Windows and Linux.
The free version does whole drive recovery only(maybe partitions, been a while) and the paid version will allow you to cherry pick files/directories. https://dmde.com