IMAGING A DRIVE

Whether or not you are recovering data from a dying disk, it’s much more convenient to work with raw images of the disk rather than the physical hardware.

Although we can use the venerable dd command to make the copy, it won’t always be a good idea. That’s because dd is designed to quit as soon as it encounters any errors, and wouldn’t be of much help on a malfunctioning disk. So instead we’ll use GNU ddrescue. It works like dd and makes block-level copies of a disk. Unlike dd however, GNU ddrescue skips over the bad blocks and copies the good blocks first.

It goes without saying to make sure you create the mirror image on a healthy drive – it could be an external USB drive or an internal one. Also make sure that while this disk is mounted, the troubled drive isn’t. Now enter: sudo ddrescue /dev/sda1 /media/diskimages/sda1.img /media/ diskimages/logfile

This will dump the contents of the sda1 partition from the physical drive to the sda1.img file on the device mounted at /media/ diskimages. The logfile records all the activity in a log, which is useful for resuming from where you left off if you need to interrupt the copy process.

Once you have a good image of the disk, you can ask ddrescue to re-read portions of the disk it couldn’t read earlier: sudo ddrescue -r 3 -C /dev/sda1 /media/diskimages/sda1.img / media/diskimages/logfile

The number of attempts ddrescue should make at reading data wherever it runs into an error is specified with the -r option. Thanks to the log file, ddrescue will only try to fill in the gaps and not attempt to read the good portions again.