Data loss can be a distressing experience, whether it's due to a hardware failure or accidental deletion. Enter GNU ddrescue, a powerful data recovery tool specially designed for these unfortunate situations. This article serves as an exhaustive guide on using GNU ddrescue on Ubuntu Linux, offering insights into its installation, safe usage practices, and real-world applications that may assist in recovering your precious data. GNU ddrescue is a proven data recovery tool which you can trust. However, it is also quite a complicated command line tool. If only there was a way to make it more straightforward to use. Enter DDRescue-GUI! Sady this is now a paid download tool. It is still worth it though.
TL:DR—GNU ddrescue provides the easiest way to copy as exact an image as possible of a failing drive and should help avoid catastrophic errors. DDRescue-GUI makes that process much easier, but before embarking on this process you should check your drive with GParted, and use the smartctl command from smartmontools to ascertain if the drive is really failing as it will be easier to recover your data by mounting the drive if it is a healthy drive.
Contents
- smartmontools - smartctl
- GParted — a graphical tool for managing disks on Linux
- Installing GParted
- GNU ddrescue
- Using ddrescue safely
- Allow tools to finish!
- Don't run tools on mounted partitions
- Don't try to repair damaged drives
- Introducing DDRescue-GUI
- Installing on Ubuntu 22.04
- An example of DDrescue-GUI in action
- Running DDRescue-Gui
- DDRescue-Gui detailed info
- DDRescue-Gui terminal output
- Completing your DDRescue-Gui operation
- Success with DDRescue-Gui
- Conclusion and final thoughts
smartmontools - smartctl
smartctl controls the Self-Monitoring, Analysis and Reporting Technology (SMART) system built into most ATA/SATA and SCSI/SAS hard drives and solid-state drives. The purpose of SMART is to monitor the reliability of the hard drive and predict drive failures, and to carry out different types of drive self-tests. It can establish if a drive is healthy!
To install smartctl, you need to use the command line.
$ sudo apt update && sudo apt install smartmontools Once installed you can check your drives SMART status. Use the correct /dev device for your drive. the -i option gives information and -a option prints all information which can be quite verbose. -x prints all SMART and non-SMART information about the device.
$ sudo smartctl -x /dev/sdaYou are looking for clues as to the status of the drive.
SMART Status: 0xc24f (PASSED)
...
SATA Phy Event Counters (GP Log 0x11)
ID Size Value Description
0x0001 2 0 Command failed due to ICRC error
0x0002 2 0 R_ERR response for data FIS
0x0003 2 0 R_ERR response for device-to-host data FIS
0x0004 2 0 R_ERR response for host-to-device data FIS
0x0005 2 0 R_ERR response for non-data FIS
0x0006 2 0 R_ERR response for device-to-host non-data FIS
0x0007 2 0 R_ERR response for host-to-device non-data FIS
0x0008 2 0 Device-to-host non-data FIS retries
0x000b 2 0 CRC errors within host-to-device FIS
0x000d 2 0 Non-CRC errors within host-to-device FIS
0x000f 2 0 R_ERR response for host-to-device data FIS, CRC
0x0010 2 0 R_ERR response for host-to-device data FIS, non-CRC
0x0012 2 0 R_ERR response for host-to-device non-data FIS, CRC
0x0013 2 0 R_ERR response for host-to-device non-data FIS, non-CRC
The status of PASSED and the many zeros in the log tell me this is a healthy drive. You don't need to run GNU DDRescue on a healthy drive. Just run GParted to explore and find where the drive is mounted on your computer. You may need to reboot with the drive connected in order to have the drive automount.
If it mounts properly use the normal tools like the files app or the command line to copy the data you are interested in to a good safe drive and thank your lucky stars you didnt have to continue.
GParted — a graphical tool for managing disks on Linux
GParted is a free partition editor for graphically managing disk partitions.
GParted allows you to resize, copy, and move partitions without data loss, enabling you to grow or shrink drives, create space for new operating systems and attempt data rescue from lost partitions.
GParted makes it very easy to understand which block device represents each drive and this is vitally important because the destination will be overwritten!
Installing GParted
$ sudo apt update && sudo apt install gpartedRun from your window manager or by pressing the system key and typing GParted into the search. Now you can click on the drop down menu on the right hand side to visually check each block device and make sure you know which is which. I can see that the Windows 8.1 drive is /dev/sdb and my destination will be /dev/sdc simple!
GNU ddrescue
GNU ddrescue is a command line tool and needs to be installed. GNU ddrescue is a utility for data recovery that excels in cloning data from one file or block device to another while prioritising the retrieval of good data in cases of read failures. Unlike traditional data copying tools that stop at errors, ddrescue meticulously records which areas are problematic and attempts to read them again later. This nuanced approach enables users to salvage as much information as possible from drives that are showing significant signs of degradation. "GNU ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying to rescue the good parts first in case of read errors."
$ sudo apt update && sudo apt install gddrescueGNU ddrescue is an essential tool for data recovery originally released in 2004 and consistently updated by the original author. As is often the case your Linux distribution might be a little behind the upstream release. Ubuntu 22.04 LTS shipped with release 1.23 which is a little behind, but for LTS users I would recommend sticking with the release provided with the LTS distribution unless you absolutely know you need a fix made in the current release.
Using ddrescue safely
You probably came here because of a data recovery issue. Please read this or risk losing your data!
With any tool capable of erasing data, there is the opportunity to make a mistake that results in the source data being damaged. You should allow the tools you run to finish, avoid running them on mounted partitions and never try to repair data on suspected damaged drives. In this case unmount the drive if you mounted it and try to recover an image of all you can onto a new good drive, ideally of the same capacity and form factor if it is destined to be a replacement for a broken computer.
Allow tools to finish!
Patience is a virtue. Some tools can take an extraordinarily long time to run. Let them!
Don't run tools on mounted partitions
Mounted partitions make a disk available to use. Unmounted disks are safe to run low level tools on.
Don't try to repair damaged drives
Make as good a copy of a damaged drive and then try to repair the copy. Damaged drives should be retired.
You should take care to remember that any data on a chosen destination will be replaced. This is why it can be helpful to have the DDRescue-GUI and optionally, GParted, to provide a better visual check before you might destroy the existing data on a destination drive!
From the GNU ddrescue Manual, all emphasis mine!
- GNU ddrescue is like any other power tool. You need to understand what it does, and you need to understand some things about the machines it does those things to, in order to use it safely.
- Never try to rescue a r/w mounted partition. The resulting copy may be useless. It is best that the device or partition to be rescued is not mounted at all, not even read-only.
- Never try to repair a file system on a drive with I/O errors; you will probably lose even more data.
- If you use a device or a partition as destination, any data stored there will be overwritten.
- Some systems may change device names on reboot (e.g. udev enabled systems). If you reboot, check the device names before restarting ddrescue.
- If you interrupt the rescue and then reboot, any partially copied partitions should be hidden before allowing them to be touched by any operating system that tries to mount and "fix" the partitions it sees.
Introducing DDRescue-GUI
For those who find the command line a daunting prospect, DDRescue-GUI provides a graphical interface that simplifies the data recovery process considerably. This front-end utility improves user experience whilst retaining the powerful capabilities of GNU ddrescue.
Installing on Ubuntu 22.04
The easiest way to install is to grab the software from the authors website. It is a paid download and you can find it at https://www.hamishmb.com/ddrescue-gui/ and you'll need to follow the author's instructions for download, making the very small payment and installation. Once installed, you can use the system key to find and run DDRescue-Gui - just type 'DDRescue' and load the app. It requires sudo permissions because it can read, write, and destroy data!
An example of DDrescue-GUI in action
I needed to image a Windows hard drive for a friend, before inspecting it to confirm or deny a ransomware attack. This necessitated removing the drive from the laptop, a Lenovo, (which was easy), then connecting it to a USB port on my Linux Computer.
I used a USB 3.0 to SATA Adapter Cable for 2.5in SSD HDD Drives (pictured).
Fortunately, I had another identical size external USB drive too, which I attached via USB. My Linux computer contains a hard drive too, so now there are three drives attached. Crucially the Windows drive and the new destination drive are not mounted.
You can use the command lsblk -e7 to list available drives (which are known as block devices). This command prints all block devices (except RAM disks) in a tree-like format by default. Use lsblk --help to get a list of all available options.
In this listing you can see the internal drive /dev/sda, the suspected bad 1TB drive /dev/sdb, and the new 1TB drive /dev/sdc. Even if you are an expert it can be hard to determine what each drive is from here but its obvious (to me that /dev/sda is my running Linux because it contains the boot partition and a large partition for everything else. If in doubt unplug all external drives and rerun this command after plugging them in one at a time until you understand what device refers to what drive.
$ sudo lsblk -e7
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 931.5G 0 disk
├─sda1 8:1 0 512M 0 part /boot/efi
└─sda2 8:2 0 931G 0 part /
sdb 8:16 0 931.5G 0 disk
├─sdb1 8:17 0 1000M 0 part
├─sdb2 8:18 0 260M 0 part
├─sdb3 8:19 0 1000M 0 part
├─sdb4 8:20 0 128M 0 part
├─sdb5 8:21 0 891.7G 0 part
├─sdb6 8:22 0 25G 0 part
└─sdb7 8:23 0 12.5G 0 part
sdc 8:16 0 931.5G 0 disk
├─sdc1 8:17 0 1000M 0 part
├─sdc2 8:18 0 260M 0 part
├─sdc3 8:19 0 1000M 0 part
├─sdc4 8:20 0 128M 0 part
├─sdc5 8:21 0 891.7G 0 part
├─sdc6 8:22 0 25G 0 part
└─sdc7 8:23 0 12.5G 0 part
Running DDRescue-Gui
Once you have DDRescue-Gui loaded choose an image source, an image destination and a recovery map file loction.
In this example a 1TB drive /dev/sdb is being copied to a new 1TB drive /dev/sdc .
DDRescue-Gui detailed info
Further information is available under Detailed info if desired.
DDRescue-Gui terminal output
Further information is available under Terminal Output if desired.
Completing your DDRescue-Gui operation
A confirmation will appear once completed. Be patient. Do not interrupt once you start! Note that a 1TB drive took about 7 hours. Just make sure your computer doesn't hibernate or sleep and leave it to finish.
Success with DDRescue-Gui
You can mount the destination once the operation is completed.
Conclusion and final thoughts
Using GNU ddrescue as a data recovery tool on Ubuntu presents users with a powerful method for salvaging lost information from failing hardware. The installation is straightforward, the commands are logical once understood, and the provision for logging makes it a sound choice for data recovery tasks. For those who prefer a graphical approach, DDRescue-GUI provides a user experience that greatly simplifies using GNU ddrescue. Understanding the fundamentals of data recovery, along with appropriate safety precautions, ensures that users can undertake this process with minimal risk.
In closing, whether you are facing a simple case of accidental deletion or dealing with a more serious hardware failure, GNU ddrescue and its graphical counterpart form robust tools in your data recovery arsenal. By adhering to sound practices and familiarising yourself with the commands and options available, you can enhance your chances of successfully rescuing your vital data. Don't despair in the face of a disk problem; let the tools available to you, GNU ddrescue, smartctl, GParted and DDRescue-GUI guide you to getting that data back!
See also:
DDRescue-GUI homepage
GNU ddrescue homepage
GNU ddrescue 1.26 released
GNU ddrescue manual
GNOME Partition Editor - GParted
