2

I'm trying to run ddrescue on a damaged hard drive. For awhile, it ran smoothly but intermittently, often going several minutes to an hour without getting any data. After, it started going fast, but only reading error, and getting tens of thousands of them. Is this a definite sign of hard drive damage, or could it be caused by something like a scrambled partition table? Also, could the disk be damaged in a way that using ddrescue could be making the damage worse? Thank you for any help provided.

1
  • 1
    I have used ddrescue successfully both on hard disk drives and DVD disks with more or less physical damages. I think it can be used in a way that keeps the damage as small as possible as described in the tutorial of info ddrescue (and in answers below). I don't know any better [free] tool for this purpose.
    – sudodus
    Sep 15, 2019 at 19:05

2 Answers 2

1

DDrescue can make the disk worse, to minimise you want to try and get the good block as quick as possible.
You can set DDrescue to copy the good blocks first using the -n flag eg:

ddrescue -f -n /dev/sdb sdb_rescue.img sdb_rescue.log

Then run DDrescue again trying to recover ( reusing the existing log will skip the successfully recovered logs) eg:

ddrescue -d -f -r3 /dev/sdb /root/sdb_rescue.img sdb_rescue.log

DDrescue can try and recover the partiton table in the state it is on the disc, then you can try and repair the partition table on the recovered image.

A failing drive tends to develop more and more errors as time passes. Because of this, you should rescue the data from a drive as soon as you notice the first error. Be diligent because every time a physically damaged drive powers up and is able to output some data, it may be the very last time that it ever will.

You should make a copy of the failing drive with ddrescue, and then try to repair the copy. If your data are really important, use the first copy as a master for a second copy, and try to repair the second copy. If something goes wrong, you have the master intact to try again.

If you are trying to rescue a whole partition, first repair the copy with e2fsck or some other tool appropriate for the type of partition you are trying to rescue, then mount the repaired copy somewhere and try to recover the files in it.

If the drive is so damaged that the file system in the rescued partition can't be repaired or mounted, you will have to browse the rescued data with an hex editor and extract the desired parts by hand or use a file recovery tool like photorec.

If the partition table is damaged, you may try to rescue the whole disc, then try to repair the partition table and the partitions on the copy.

https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html#Examples

0

from the ddrescue manual https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html

Never try to rescue a r/w mounted partition. The resulting copy may be useless. It is best that the device or partition to be rescued is not mounted at all, not even read-only.

Never try to repair a file system on a drive with I/O errors; you will probably lose even more data.

So yes, in answer to your question, ddrescue could be making matters worse indeed any procedure which tinkers with a damaged (or even undamaged) volume has the capacity to do further damage.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .