Before imaging the corrupted filesystem to a file on another hard drive, I decided to dry-run ddrescue (throwing rescued output to /dev/null) just to see how much data is unreadable:

# ddrescue -d -b 4096 -r 3 -f /dev/sda1 /dev/null sda1.log

In the end it took 3 days to finish. Now I'm ready to make a real image, but I don't want to wait another 3 days until it finishes. But, luckily because I have a logfile, is it possible to force ddrescue to rescue only the good sectors and do not touch bad ones?

Having read some documentation, I've came up with the following idea:

# ddrescue -d -b 4096 --fill=+ /dev/sda1 /mnt/sda1.img sda1.log

Will this work? Is there another (preferred) way of rereading only good sectors?

  • I thought it didn't even try to reread at all by default... In fact, you told it to retry 3 times, -r 3. -n may also save time, although I guess it won't try to get as much data as possible. – njsg Jan 10 '13 at 12:09
  • So that's why I came up with the idea of using --fill=+ option ("fill mode") – evaldaz Jan 10 '13 at 12:17

Thoroughly reread ddrescue manual and found out the following option:

-m file

Restrict the rescue domain to the blocks marked as finished in the logfile file. This is useful if the destination drive fails during the rescue.

So the invocation of ddrescue would look something like this:

# ddrescue -d -b 4096 -m sda1.log /dev/sda1 /mnt/sda1.img logfile2.log

Quick edit 2018:

I use ddrescue sometimes, from some years ago, for rescuing hard-drive.

Something quicker than dd on hdd with really broken surfaces.

But dd is really safe and my first post stay true.

Original post

This is a very bad idea!

I'm talking about Before imaging the corrupted filesystem to a file on another hard drive...

As when a disk drive come to be corrupted, corruption are generally growing each time you try to access your drive.

So the good way to rescue a broken drive is to make an image by copying whole disk from begin to end in one uninterrupted operation!. After that: unplug the disk drive and store them quietly. As: less you touch the broken drive, more chance you have to restore something.

As each time mechanical access to broken material could make some more damages, the log you're become from your last operation is not a reference for knowing wich block are damaged now.

I personally, don't use ddrescue. I use dd from a while and this tool make all I need:

dd bs=512 if=/dev/sdX of=/backuprepo/sdXBroken.img conv=noerror,sync

And, I let it work patiently.

| improve this answer | |
  • Using dd without a block size (bs) set makes FSM sad. – laebshade Jan 11 '13 at 22:55
  • "corrupted filesystem" - if he is lucky, he only has a software issue, not a hardware issue :) – PythoNic Nov 17 '16 at 16:53
  • stick to ddrescue - dd noerror sync corrupts data superuser.com/a/1075837/195171 – frostschutz Jan 23 '19 at 13:49
  • @frostschutz, The link you point to is a very special case, using virtual block devices and non-standard device block size. In all normal cases, trying to backup physical drive, using conv=noerror,sync is correct. For special case, you may have to explicitely specify ibs and obs. But that's no matter with the main subject of my answer: When things goes wrong don't try else than backup immediately – F. Hauri Jan 23 '19 at 16:00

Knowing what ddrecue does, you should not use it to write to /dev/null while recovering data from broken disk, but to get "at least something" using writes into real image file.

Writing to /dev/null has sence e.g. if you want to know for brand-new disk if to return it to the store.

In this case, i would not use log file from "/dev/null attempt", but empty/new one, and then trying eventually more times couple of passes, depending how it does...

| improve this answer | |
  • pretty sure this doesn't address the question of "Is there another (preferred) way of rereading only good sectors?" – Jeff Schaller May 20 '16 at 16:15
  • @JeffSchaller: which means this should be a comment to the question -> not possible with the low points – PythoNic Nov 17 '16 at 16:54
  • To which the easy answer is: get more points! (By providing answers that people find useful and up-vote) – Jeff Schaller Nov 17 '16 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.