1

I'm trying to recover data from damaged 3TB drive. I'm using ddrescue to make an image of it, but it takes forever while there are lots of read errors. I was wondering if I can have some luck with first 200GB (with large wholes in it) that I already copied. I read the partition table with gdisk and found the offset of ext4 file system that I'm interested in reading. Then created loop device to have a nice way of interacting with the partition:
sudo losetup -f --show -o $((xxxxxxxxxxx*512))

sudo tune2fs -l /dev/loop16 gives me some info so I think I'm on a right track.

Unfortunately I can't mount it because of the file system errors and e2fsck won't fix anything as it's trying to read beyond the image file boundaries. I suppose there may be some important file system data in later areas of the partition. Do you have any advice on how I could trick the system to ignore the errors and try to work with incomplete inode structure and within the truncated image?

Thanks.

1 Answer 1

2

If the image size is too small, you can use fallocate or truncate to make it larger, or use dmsetup to create a linear device mapping to create a virtual larger device.

$ ls -lh somefile
-rw-r--r-- 1 user user 200G Sep  9 13:27 somefile
$ truncate -s 2T somefile
$ ls -lh somefile
-rw-r--r-- 1 user user 2.0T Sep  9 13:28 somefile

To make ddrescue skip bad areas in the first pass, try something like --min-read-rate=10M.

As for the loop device, it should be read-only, or read-write on a copy of the image, or use a copy-on-write overlay for experiments. Otherwise you might end up modifying the image and have to do it over which is a bad idea since the source drive is already dying.

1
  • Thank you, truncate worked. Now I'm able to open it in debugfs and see some indoes under /. Unfortunately, they are placed in blocks, that are above what I copied so far :(.
    – Liberat0r
    Commented Sep 9, 2019 at 13:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .