Using GNU ddrescue for hard disk recovery on Ubuntu Linux

GNU ddrescue for hard disk imaging or recovery on Ubuntu 24.04 LTS

GNU ddrescue (ddrescue) is a proven data recovery tool which you can trust. However, it is also quite a complicated command line tool. If only there was a way to make it more straightforward to use.

Contents

ddrescue is an essential tool for data recovery originally released in 2004 and consistently updatedover time. As is often the case your Linux distribution might be a little behind the upstream release. Ubuntu 24.04 LTS has release 1.27 which is only a little behind the current release, but for LTS users I would recommend sticking with the release provided with the LTS distribution unless you absolutely know you need a fix made in the current release.

Using ddrescue safely

With any tool capable of erasing data, there is the opportunity to make a mistake that results in the source data being damaged. You should allow the tools you run to finish, avoid running them on mounted partitions and never try to repair data on suspected damaged drives. In this case unmount the drive if you mounted it and try to recover an image of all you can onto a new good drive, ideally of the same capacity and form factor if it is destined to be a replacement for a broken computer.

You should take care to remember that any data on a chosen destination will be replaced. This is why it can be helpful to have the DDRescue-GUI and optionally, GParted, to provide a better visual check before you might destroy the existing data on a destination drive!

From the GNU ddrescue Manual, all emphasis mine!

An example of DDrescue in action

I needed to image a Windows hard drive for a friend, before inspecting it to confirm or deny a ransomware attack. This necessitated removing the drive from the laptop, a Lenovo, (which was easy), then connecting it to a USB port on my Linux Computer.

I used a USB 3.0 to SATA Adapter Cable for 2.5in SSD HDD Drives (pictured).

Fortunately, I had another identical size external USB drive too, which I attached via USB. My Linux computer contains a hard drive too, so now there are three drives attached. Crucially the Windows drive and the new destination drive are not mounted.

You can use the command lsblk -e7 to list available drives (which are known as block devices). This command prints all block devices (except RAM disks) in a tree-like format by default. Use lsblk --help to get a list of all available options.

In this listing you can see the internal 1TB drive /dev/sda, and an external 500GB drive /dev/sdb. Even if you are an expert it can be hard to determine what each drive is from the device name but its obvious (to me that /dev/sda is my running Linux because it contains the boot partition and a large partition for everything else. If in doubt unplug all external drives and rerun this command after plugging them in one at a time until you understand what device refers to what drive.

$ sudo lsblk -e7
sudo lsblk -e7
NAME MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
sda    8:0    0 931.5G  0 disk 
├─sda1
│      8:1    0     1G  0 part /boot/efi
└─sda2
       8:2    0 930.5G  0 part /var/snap/firefox/common/host-hunspell
                               /snap
                               /
sdb    8:16   0 465.8G  0 disk 
├─sdb1
│      8:17   0   100M  0 part 
├─sdb2
│      8:18   0    16M  0 part 
├─sdb3
│      8:19   0 464.8G  0 part /media/username/XXXXXXXX12345678
└─sdb4
       8:20   0   825M  0 part

GParted — a graphical tool for managing disks on Linux

GParted is a free partition editor for graphically managing disk partitions.

GParted allows you to resize, copy, and move partitions without data loss, enabling you to grow or shrink drives, create space for new operating systems and attempt data rescue from lost partitions. 

GParted makes it very much easier to understand which block device represents each drive and this is vitally important because the destination will be overwritten!

Installing GParted

$ sudo apt update 
$ sudo apt install gparted

In GParted you can click on the drop down menu on the right hand side to visually check each block device and make sure you know which is which. In this screenshot you can see that what is obviously a Windows 8.1 drive is /dev/sdb.

Installing ddrescue

$ sudo apt install gddrescue

Using ddrescue

In this example (taken from the ddrescue documentation) a drive /dev/sdb is being copied to a new drive /dev/sdc, using -f to overwrite the output device, and -r3 to retry for a maximum of three passes. finally it writes a mapfile called mapfile, which is a data file about the operation. Don't just copy this command. Pay attention to device names!

$ ddrescue -f -r3 /dev/sdb /dev/sdc mapfile

Be patient with ddrescue! Do not interrupt once you start! Note that a 1TB drive took about 7 hours. Just make sure your computer doesn't hibernate or sleep and leave it to finish.

Installing DDRescue-GUI on Ubuntu 24.04

DDRescue-GUI helps users recover important data fast, using GNU ddrescue but without having to understand the command line, which can be daunting.

See also:
DDRescue-GUI homepage
GNU ddrescue homepage
GNU ddrescue manual
GNOME Partition Editor - GParted