GNU ddrescue
GNU ddrescue is a proven data recovery tool which you can trust. However, it is also quite a complicated command line tool. If only there was a way to make it more straightforward to use. Enter DDRescue-GUI! Sady this is now a paid download tool.
TL:DR—This is the easiest way to copy as exact an image as possible of a drive and should help avoid catastrophic errors.
Contents
- GNU ddrescue
- Using ddrescue (and DDRescue-GUI) safely
- Allow tools to finish!
- Don't run tools on mounted partitions
- Don't try to repair damaged drives
- DDRescue-GUI
- Installing on Ubuntu 22.04
- An example of DDrescue-GUI in action
- Optional, Install GParted — a graphical tool for managing disks on Linux
- Installing GParted
- Running DDRescue-Gui
- DDRescue-Gui detailed info
- DDRescue-Gui terminal output
- Completing your DDRescue-Gui operation
- Success with DDRescue-Gui
GNU ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying to rescue the good parts first in case of read errors.
GNU ddrescue is an essential tool for data recovery originally released in 2004 and consistently updated by the original author. As is often the case your Linux distribution might be a little behind the upstream release. Ubuntu 22.04 LTS shipped with release 1.23 which is a little behind, but for LTS users I would recommend sticking with the release provided with the LTS distribution unless you absolutely know you need a fix made in the current release.
Using ddrescue (and DDRescue-GUI) safely
You probably came here because of a data recovery issue. Please read this or risk losing your data!
With any tool capable of erasing data, there is the opportunity to make a mistake that results in the source data being damaged. You should allow the tools you run to finish, avoid running them on mounted partitions and never try to repair data on suspected damaged drives. In this case unmount the drive if you mounted it and try to recover an image of all you can onto a new good drive, ideally of the same capacity and form factor if it is destined to be a replacement for a broken computer.
Allow tools to finish!
Patience is a virtue. Some tools can take an extraordinarily long time to run. Let them!
Don't run tools on mounted partitions
Mounted partitions make a disk available to use. Unmounted disks are safe to run low level tools on.
Don't try to repair damaged drives
Make as good a copy of a damaged drive and then try to repair the copy. Damaged drives should be retired.
You should take care to remember that any data on a chosen destination will be replaced. This is why it can be helpful to have the DDRescue-GUI and optionally, GParted, to provide a better visual check before you might destroy the existing data on a destination drive!
From the GNU ddrescue Manual, all emphasis mine!
- GNU ddrescue is like any other power tool. You need to understand what it does, and you need to understand some things about the machines it does those things to, in order to use it safely.
- Never try to rescue a r/w mounted partition. The resulting copy may be useless. It is best that the device or partition to be rescued is not mounted at all, not even read-only.
- Never try to repair a file system on a drive with I/O errors; you will probably lose even more data.
- If you use a device or a partition as destination, any data stored there will be overwritten.
- Some systems may change device names on reboot (e.g. udev enabled systems). If you reboot, check the device names before restarting ddrescue.
- If you interrupt the rescue and then reboot, any partially copied partitions should be hidden before allowing them to be touched by any operating system that tries to mount and "fix" the partitions it sees.
DDRescue-GUI
DDRescue-GUI helps users recover important data fast, using GNU ddrescue but without having to understand the command line, which can be daunting.
Installing on Ubuntu 22.04
The easiest way to install is to add the author's repository to your Ubuntu sources. Then you can install and update in the usual way.
$ sudo add-apt-repository ppa:hamishmb/myppa
$ sudo apt update
$ sudo apt install ddrescue-gui
Now you can use the system key to find and run DDRescue-Gui - just type 'DDRescue' and load the app. It requires sudo permissions because it can read, write, and destroy data!
An example of DDrescue-GUI in action
I needed to image a Windows hard drive for a friend, before inspecting it to confirm or deny a ransomware attack. This necessitated removing the drive from the laptop, a Lenovo, (which was easy), then connecting it to a USB port on my Linux Computer.
I used a USB 3.0 to SATA Adapter Cable for 2.5in SSD HDD Drives (pictured).
Fortunately, I had another identical size external USB drive too, which I attached via USB. My Linux computer contains a hard drive too, so now there are three drives attached. Crucially the Windows drive and the new destination drive are not mounted.
You can use the command lsblk -e7 to list available drives (which are known as block devices). This command prints all block devices (except RAM disks) in a tree-like format by default. Use lsblk --help to get a list of all available options.
In this listing you can see the internal drive /dev/sda, the suspected bad 1TB drive /dev/sdb, and the new 1TB drive /dev/sdc. Even if you are an expert it can be hard to determine what each drive is from here but its obvious (to me that /dev/sda is my running Linux because it contains the boot partition and a large partition for everything else. If in doubt unplug all external drives and rerun this command after plugging them in one at a time until you understand what device refers to what drive.
$ sudo lsblk -e7
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 931.5G 0 disk
├─sda1 8:1 0 512M 0 part /boot/efi
└─sda2 8:2 0 931G 0 part /
sdb 8:16 0 931.5G 0 disk
├─sdb1 8:17 0 1000M 0 part
├─sdb2 8:18 0 260M 0 part
├─sdb3 8:19 0 1000M 0 part
├─sdb4 8:20 0 128M 0 part
├─sdb5 8:21 0 891.7G 0 part
├─sdb6 8:22 0 25G 0 part
└─sdb7 8:23 0 12.5G 0 part
sdc 8:16 0 931.5G 0 disk
├─sdc1 8:17 0 1000M 0 part
├─sdc2 8:18 0 260M 0 part
├─sdc3 8:19 0 1000M 0 part
├─sdc4 8:20 0 128M 0 part
├─sdc5 8:21 0 891.7G 0 part
├─sdc6 8:22 0 25G 0 part
└─sdc7 8:23 0 12.5G 0 part
Optional, Install GParted — a graphical tool for managing disks on Linux
GParted is a free partition editor for graphically managing disk partitions.
GParted allows you to resize, copy, and move partitions without data loss, enabling you to grow or shrink drives, create space for new operating systems and attempt data rescue from lost partitions.
The focus of this article is on DDrescue-GUI, but GParted makes it very easy to understand which block device represents each drive and this is vitally important because the destination will be overwritten!
Installing GParted
$ sudo apt update
$ sudo apt install gparted
Now you can click on the drop down menu on the right hand side to visually check each block device and make sure you know which is which. I can see that the Windows 8.1 drive is /dev/sdb and my destination will be /dev/sdc simple!
Running DDRescue-Gui
Once you have DDRescue-Gui loaded choose an image source, an image destination and a recovery map file loction.
In this example a 1TB drive /dev/sdb is being copied to a new 1TB drive /dev/sdc .
DDRescue-Gui detailed info
Further information is available under Detailed info if desired.
DDRescue-Gui terminal output
Further information is available under Terminal Output if desired.
Completing your DDRescue-Gui operation
A confirmation will appear once completed. Be patient. Do not interrupt once you start! Note that a 1TB drive took about 7 hours. Just make sure your computer doesn't hibernate or sleep and leave it to finish.
Success with DDRescue-Gui
You can mount the destination once the operation is completed.
See also:
DDRescue-GUI homepage
GNU ddrescue homepage
GNU ddrescue 1.26 released
GNU ddrescue manual
GNOME Partition Editor - GParted
