1

Background

I had a problem under Windows with ndis.sys [sys don't start] Status: 0xc00000e9 Info: Windows failed to load because a critical system driver... To repair I had to fully decrypt drive [encrypted with TrueCrypt]. Encryption was running fine, but at some point it found a bad sector.

enter image description here

At some point it slowed down decryption process significantly. As I was thinking it's a disk problem - I did a search and came across - option to do a full drive backup with Linux dd command. That supposed to give me image of whole HDD drive in case of ongoing corruption and possibility to run decryption from different drive.

Lenovo G500s

to rescue sda

What I did so far

sudo mkdir /mnt/usb
sudo mount /dev/sdb2 /mnt/usb
sudo chmod -R 777 /mnt/usb
sudo dd if=/dev/sda of=/mnt/usb/image.dd conv=noerror

The result being

dd: error reading '/dev/sda': Input/output error
254256+0 records in
254256+0 records out

I have just noticed I can do image trough Disks [I work on latest Knoppix DVD], but didn't try it yet. Also I was getting suggestions that I can use dd_rescue, but has heard it is not exactly safe to the data on drive as it over-writes bad blocks? And didn't try it yet.

I'm stuck, please help, I don't have a full backup of latest work from my sys partition, although seems that sda3 / sda5 was fully decrypted.

  • Please note that ddrescue is a tool distinct from dd. ddrescue is also better at dealing with marginal media; conv=noerror simply skips unreadable blocks in the input when writing to the output, but that messes up offsets. You should be using ddrescue on any marginal or potentially marginal media. – a CVn Nov 7 '16 at 16:29
1

Don't worry about ddrescue. It doesn't over-write bad blocks. Who told that this program is unsafe, they got rescued bad sector not the same it was be. But if bad sector is corrupted it has corrupted data and the ddrescue program tryes to read this sector several times and gives each time different data. This program uses average of different data to try to rescue them. Many of rescued bad sectors have wrong data.

Full rescue is possible only from backup. RAID isn't backup. But it allows you quickly replace bad disk and restore functionality.

You can find good example of using ddrescue at http://forensicswiki.org/wiki/Ddrescue

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.