Salvaging hard drives with ddrescue

DISCLAIMER: Below I describe my experiences and solutions that worked in my case. If you follow the suggestions, you should understand what you are doing and how ddrescue works. If you are a tiny bit unsure and critical data is at stake, go consult a professional data recovery company. They are surprisingly cheap.

Recently I was faced with a failing hard drive. It was an external 320 GB USB drive that was only 6 months old and was always handled carefully. But now it refused to mount and S.M.A.R.T. was reporting bad sectors. And let's not get stuck with discussing timely backups...

Old drives can have some bad sectors and that is allright, but a new drive with bad sectors or a drive with increasing number of bad sectors should initiate "a data evacuation".  The idea is that you should read out the good parts as quickly as possible, because every time the drive spins, it might be the last time. For evacuation you need a healthy drive as a target drive. After data is copied, you can use data recovery software such as iRecover to dig out the files from the healthy drive.

Reading a drive with bad sectors is not easy. Every attempt to read a bad sector causes a wait due to retries and timeouts. Even if the ratio of bad sectors is minimal, you still have a Huge Number of them because modern hard drives are huge. And when you multiply short wait time by that Huge Number, you get A Very Long Time to read through the drive. In my case, an overnight of churning the disk did not result into any measurable progress.

So using any of the normal data moving tools, like cp or dd, does not work. However what does work is a very nice open source utility called ddrescue. It is basically a version of dd that can handle partly functional drives.

For information on ddrescue, see the manual:

http://www.gnu.org/s/ddrescue/manual/ddrescue_manual.html

Before you start, go and get the latest version of ddrescue. At least with my Ubuntu, the default version was a bit old and missed some good features.

The first step is to run ddrescue with -n flag, so that it will skip over all problematic areas, making the first pass quick and easy on the failing drive. In my case it recovered 77 GB of data, which was already a lot better than nothing.

Next part was trickier. I could not come up with a parameter combination that would have made ddrescue read through the troubled areas efficiently. Without -n, it was always doing some sort of linear read that got stuck eventually. However I found out that I was able to manually start the read from some good location and stop it when it got stuck. This way I was able to recover more data, but it was a lot of work.

Fortunately that process could be automated by writing a bit of script code. This is what I came up with and it worked very well for my case. 

#!/bin/perl

#$status = "[*\?/]"; # try also other types of blocks
$status = "[\?]";
@array=`grep $status logfile`;

while (scalar(@array) > 0) {

	@randomline=split(/ /, $array[rand @array]);

	$cmd = "ddrescue -f -E 10000 -i " . @randomline[0] . " /dev/sda /dev/sdb logfile\n";

	print($cmd);
	system($cmd);

	@array=`grep $status logfile`;
}
 

The script uses ddrescue logfile to come up with good candidates where to look for readable data. It picks a random untried block and starts ddrescue from there. The key parameter is -i that gives the start offset. Another important parameter is -E that defines the maximum error increase, so that ddrescue will quickly give up and we pick another random location. A value of 10000 bytes worked well for me, but you might want to tune it to your needs.

Now I have recovered 317 GB, which means about 99% of the drive. It will probably go even higher if I go on running that script. It would be nice to hear your experience from rescuing hard drives and ways to get best out of ddrescue. This was my first and hopefully last serious hard drive rescue operation, so my approach is by no means an optimal one.

A couple of things I learned in the process: ALWAYS double check the source and destination devices when issuing ddrescue commands. You will be working in multiple sessions and external drives will not always have the same device names.

The common advice is that you should open USB drive boxes and connect them directly, not via USB. I could not be bothered about this and it did not seem to matter. The screw in the drive box was not compatible with my screw drivers and a trip to hardware store would have been required. Mind you, I am a programmer, not a hardware guy...