Rescuing and restoring data

Padding

Both tools replace unreadable locations in the image file with zeros. Although this method might make it impossible to save the full structure, you might at least rescue part of it. Because the image generated by ddrescue can be extremely large, you need to save it to a partition that can deal with these chunks of data. This means that external USB hard disks with FAT32 filesystems are not suitable.

The following example copies the content of the /dev/sde1 partition to /home/tim/copy.img:

ddrescue /dev/sde1 /home/tim/copy.img logfile

This command stores information in logfile that allows you to interrupt the copy with Ctrl+C and then continue later with the same command (Figure 4). You can also save the entire disk, rather than just the sde1 partition:

Figure 4: Even though you can interrupt ddrescue and carry on copying later, it makes more sense to avoid interruptions if possible. With hard drives, in particular, you might only have one chance, depending on the damage profile.
ddrescue /dev/sde /home/tim/copy.img logfile

This command makes sense in particular if blkid does not recognize any partitions or if you know that the partition table is damaged. If possible, you should create a copy of the image you create. If rescue attempts fail, at least you do not need to waste time reading the faulty disk again. On a more granular level, if you cannot read an individual file, you can at least save its readable parts with the

ddrescue file.txt /media/rescue/file.txt

command.

Cliffhanger

Once you have used ddrescue to back up a partition, you can try to mount the partition. The following command mounts it as read-only in the /mnt directory for safety's sake:

mount -o loop,ro /home/tim/copy.img /mnt

Now back up all the important files from the /mnt directory. In the case of the memory card from the camera, a few photos have already appeared again below /mnt. After quickly checking with the photographer, it seems that more than half the shots are still missing. So, now it's time to fire the big guns, which only work on umounted media; in other words, time to umount /mnt.

Checker

If the partition in question uses an ext filesystem, you can now use the command fsck to fix it:

fsck.ext3 -p copy.img

The parameter -p tells fsck to correct the problems directly. On an ext4 filesystem, you would use fsck.ext4 instead of fsck.ext3. Similarly, fsck.vfat repairs partitions with a FAT32 filesystem, which is used on USB sticks and SD cards. Once fsck has completed its work, you can mount the image as before and read the files.

Similar repair tools exist for other filesystems. On NTFS filesystems, for example, ntfsfix will help; it is part of the ntfsprogs collection, which in turn is part of the NTFS driver. The tool is therefore installed by default on most distributions, so that the ntfsfix copy.img command will fix the image directly.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Top 10 Knoppix Rescue Tricks

    The Knoppix Live Linux distro is packed with powerful tools for fixing broken systems. We ask Knoppix creator Klaus Knopper for his favorite Knoppix rescue tricks.

  • Data Reconstruction

    One false click can quickly delete important data, or even an entire partition. If a backup tool is missing, only a rescue specialist can help.

  • SystemRescueCd

    The SystemRescueCd live system contains numerous tools that you can use to recover deleted files or a defective system.

  • Parted Magic

    It's really annoying when a disk suddenly dies on you or a typo in a command deletes important data. The free Parted Magic Live distro offers help.

  • SystemRescueCd

    If you accidentally delete data or format a disk, good advice can be expensive. Or maybe not: You can undo many data losses with SystemRescueCd.

comments powered by Disqus