ddrescue newbie
Hey,
I appreciate the work gone into this remix. great. I tried installing and running ddrescue from the ubuntu live cd, but that was terribly slow and become unresponsive. However, your versions light and works great.
This is actually the 1st time I am using ddrescue to recover my drive that broke down (probably due to bad sectors) a month back. Last time I tried I never managed to get to finish recovering the whole disk.
Its a 60GB disk.
I am running ddrescue now from rescue-remix live cd, and its been running for over 10 days now. and it seems to have rescued 47377MB. As i said the disk is 60GB. it showing a lot of errors. currently error size is 435MB.
Now as i have never used ddrescue comprehensively in past - is there any way I can review what it has copied so far? I would like to know is it possible for me to stop it and mount the image and see the data, possibly copy out important data, resume if more data is required or call off the recovery?
Please advice.
Thanks very much.
Did you run it with the log
Did you run it with the log option?
If so, then you can stop and resume any time you like.
If you didn't and are running the latest version, there is a --generate-logfile option that you can use to create a logfile from a recovered image.
To resume a pass at data recovery, use the -C option:
sudo ddrescue -C /dev/sdc imagefile log
where imagefile and log are whatever you are using as those filenames.
As far as checking what you got, did you image the whole drive or just the partition? You can mount the partition as a loop filesystem:
mkdir recover
sudo mount -r -o loop imagefile recover
It's important to mount it read-only (-r) if you are going to try to recover more data to that image at a later time.
If you rescued the whole drive, you can mount a partition on the drive the same way, but you have to specify an offset for where the partition begins. You can find that out using the mmls tool. See here:
https://help.ubuntu.com/community/DataRecovery#head-d6059ccf5604d2fbce38...
Unless I was getting more data on every pass, I would stop every now and then and try cooling the drive in the freezer for a few hours. I have had a lot of success doing that.
Thanks for your response
Thanks for your response Andrew.
Yes I did run it with the log option. I am not sure what version of ddrescue I am running I am using the gutsy gibbon rescue remix edition plain as default. So I am running what this version has I suppose.
I cannot go back to see what command I ran unless I stop the copying. But it was something like this:
>sudo ddrescue /dev/sda1 /disk/backup.img /disk/backup.log
I fetched the device name(dev/sda1)by running this command:
>sudo fdisk -l
Its been running for over 10 days as I said.
I imaged the whole disk i think. Please see the command above. But i am not too sure thats
I am not entirely sure what you mean by saying 'to resume a "pass", use -C option'. Do you mean - to resume copying I can use the -C option?
Also, just to confirm I havent finished copying the entire disk - I say that from (rescued 47618MB + errsize 443MMb < 60GB - size of my disk). So I think it would now make sense to stop copying and mount it using the command you just mentioned?
>sudo mount -r -o loop imagefile recover
And I remember seeing "Hit Ctrl+C to stop copying or something" and nothing this time. It pops up a lot of error messages though.
Should I just hit ctrl+c to stop it and mount it with the read-only option as you said?
I dont think I can attach a screenshot here.
Thanks again.
Regards.
Hi, can someone please post
Hi, can someone please post the correct syntax example for --generate-logfile option
I tried the following:
sudo ddrescue -g /root/rescue/backup.img /root/rescue/logfile-1.log
but I get this message:
ddrescue: logfile must be specified in generate-logfile mode
Thank you.
When everything else fails,
When everything else fails, READ the manual ;o)):
Found it:
sudo ddrescue -g /dev/sdb1 /root/rescue/backup.img /root/rescue/logfile.log
The error messages may be
The error messages may be the kernel complaining that the hard disk is showing read-errors. (This is no surprise...)
You can stop any time. Since you are using a log, you can resume any time after that. Just put a "-C" on the command line.
One pass is one attempt to read the entire drive. Once it finishes reading it will go back and try to read the error parts in smaller pieces. If you add a -r switch to the command, it will repeat the process that number of times.
OK great. Thanks. Also, it
OK great. Thanks.
Also, it seems since I have started the copying speed has reduced considerably.
At the moment it is running at a max speed of something around 32-64KB..
Could this be because of the drive being over heated?
Cheers
I don't know. It
I don't know. It depends.
If you are not getting any new data, you can stop and let the drive cool for a bit before resuming. If you are still getting new data at this point, you can keep going.
It doesn't hurt to keep the drive cool, though. A fan or even ices packs wrapped in plastic ziplock backs so that the drive doesn't get wet would be good.
Thanks Andrew. I kept it
Thanks Andrew.
I kept it going as it was copying data.
However, I am still having trouble mounting this image. Could you clarify please, do I have to have the entire disk image first before I could mount the partition? My partition is about 55 GB, and it has rescued 56954 MB at the moment.
As per you previous post, I interrupted the copying - and used this command,
>sudo mount -o loop,offset=32256 xdisk/Backup.img xdisk/recovered. this comes back with an error -
Failed to read last sector (117210176): Invalid argument
Perhaps the volume is a RAID/LDM but it wasnt setup yet, or the wrong device was used, or the partition table is incorrect.
Failed to mount '/dev/loop6': Invalid argument
The device '/dev/loop6' doesn't have a valid NTFS.
May be you selected the wrong device? Or the whole disk instead of a partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
Can you suggest a way out please. How can I mount this partition? Is it a wrong command? Or should I continue copying and copy as much as it can?
Thanks in advance.
Continue copying. It may be
Continue copying. It may be that your NTFS filesystem is borked, but that doesn't mean you can't recover the files using data-carving software.
Are you sure that the filesystem starts at 32256 (63 blocks?)
Thanks again. Yes I think my
Thanks again.
Yes I think my filesystem starts at 63 blocks. Heres what I ran:
$mmls xdisk/Backup.img -b
DOST Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Size Description
00: ----- 0000000000 0000000000 0000000001 0512B Primary Table (#0)
01: ----- 0000000001 0000000061 0000000062 0031K Unallocated
02: 00:00 0000000063 0117210239 0117210117 0055G NTFS (0x07)
$ _
NTFS borked? What is data-carving? By data-carving do you mean Foremost? How does it work? What will I need to do? I have tried getting a hang on it with some docs, but theres not a lot that I found I could understand easily.
Do you suggest I continue copying till it copies the entire disk?
Sorry for asking so many questions - but I appreciate your help.
Thanks.
Yes, continue copying the
Yes, continue copying the whole disk and if it still cnnot mount, use foremost or photorec to recover files:
https://help.ubuntu.com/community/DataRecovery#head-b504c62500146c5a9c18...
Post new comment