Sooner or later your Linux Desktop or Linux server hard drive will start breaking up, whether you have a hardware or software RAID 1, 6 or 10 you can and good hard disk health monitoring software you can react on time but sometimes as admins we have to take care of old servers which either have RAID 0 or missing RAID configuration and or disk firmware is unable to recognize failing blocks on time and remap them. Thus it is quite useful to have techniques to save data from failing hard disk drives with physical badblocks.
With ddrescue tool there is still hope for your Linux data though disk is full of unrecoverable I/O errors.
apt-cache show ddrescue
apt-cache show ddrescue|grep -i description -A 12
Description: copy data from one file or block device to another
dd_rescue is a tool to help you to save data from crashed
partition. Like dd, dd_rescue does copy data from one file or
block device to another. But dd_rescue does not abort on errors
on the input file (unless you specify a maximum error number).
It uses two block sizes, a large (soft) block size and a small
(hard) block size. In case of errors, the size falls back to the
small one and is promoted again after a while without errors.
If the copying process is interrupted by the user it is possible
to continue at any position later. It also does not truncate
the output file (unless asked to). It allows you to start from
the end of a file and move backwards as well. dd_rescue does
not provide character conversions.
To use ddrescue for saving data first thing is to shutdown the Linux host boot the system with a Rescue LiveCD like SystemRescueCD – (Linux system rescue disk), Knoppix (Most famous bootable LiveCD / LiveDVD), Ubuntu Rescue Remix or BackTrack LiveCD – (A security centered "hackers" distro which can be used also for forensics and data recovery), then mount the failing disk (I assume disk is still mountable :). Note that it is very important to mount the disk as read only, because any write operation on hard drive increases chance that it completely becomes unusable before saving your data!
To make backup of your whole hard disk data to secondary mounted disk into /mnt/second_disk
# mkdir /mnt/second_disk/rescue # mount /dev/sda2 /mnt/second_disk/rescue # dd_rescue -d -r 10 /dev/sda1 /mnt/second_disk/rescue/backup.img
# mount -o loop /mnt/second_disk/rescue/backup.img
In above example change /dev/sda2 to whatever your hard drive device is named.
Whether you have already an identical secondary drive attached to the Linux host and you would like to copy whole failing Linux partition (/dev/sda) to the identical drive (/dev/sdb) issue:
ddrescue -d -f -r3 /dev/sda /dev/sdb /media/PNY_usb/rescue.logfile
If you got just a few unreadable files and you would like to recover only them then run ddrescue just on the damaged files:
ddrescue -d –R -r 100 /damaged/disk/some_dir/damaged_file /mnt/secondary_disk/some_dir/recoveredfile
-d instructs to use direct I/O
-R retrims the error area on each retry
-r 100 sets the retry limit to 100 (tries to read data 100 times before resign)
Of course this is not always working as on some HDDs recovery is impossible due to hard physical damages, if above command can't recover a file in 10 attempts it is very likely that it never succeeds …
A small note to make here is that there is another tool dd_rescue (make sure you don't confuse them) – which is also for recovery but GNU ddrescue performs better with recovery.
How ddrescue works is it keeps track of the bad sectors, and go back and try to do a slow read of that data in order to read them.
By the way BSD users would happy to know there is ddrescue port already, so data recovery on BSDs *NIX filesystems if you're a Windows user you can use ddrescue to recover data too via Cygwin.
Of course final data recovery is also very much into God's hands so before launching ddrescue, don't forget to say a prayer 🙂
