Guide to Data Recovery with ddrescue

When disaster strikes and you’re faced with a failing hard drive or corrupted data, ddrescue can be your lifeline. Designed to rescue data from failing drives with a sophisticated multi-phase approach.

General rules:

Always use a mapfile
Start with non-aggressive options first
Be patient - good recovery takes time
Keep the original drive safe and work from copies when possible

What Makes ddrescue Special?

Unlike simple tools like dd, ddrescue is specifically designed for data recovery. It uses an algorithm that:

Prioritizes reading good sectors first to get as much data as possible quickly (important!)
Keeps track of failed areas to resume interrupted recoveries
Uses multiple passes with different strategies to maximize recovery
Handles bad sectors gracefully without getting stuck

Basic Usage

The simplest way to start a recovery of a disk is:

ddrescue -d /dev/sda output.img output.mapfile

-d: Enables direct disk access, bypassing the system cache
/dev/sda: The source device we’re trying to recover
output.img: Where the recovered data will be saved
output.mapfile: A crucial file that tracks recovery progress

Always use a mapfile! It allows you to:

Resume interrupted recoveries
Retry bad sectors later
Keep track of what’s been recovered

Example Scenarios

Scenario 1: Recovering a Specific Partition

If you only need to recover a specific partition rather than the entire drive:

ddrescue -d /dev/sda1 partition1.img partition1.mapfile

Scenario 2: Partial Recovery with Size Limits

When you want to recover a specific region of the drive:

# Start at 30GB into the drive
ddrescue -i30GiB /dev/sda output.img output.mapfile

# Recover only 10GB
ddrescue -s10GiB /dev/sda output.img output.mapfile

# Combine both: Start at 30GB and recover 10GB
ddrescue -i30GiB -s10GiB /dev/sda output.img output.mapfile

Scenario 3: Recovery with Multiple Passes

For troubled drives, you might want to use specific passes:

# Only use passes 1, 3, and 4
ddrescue --cpass=1,3-4 /dev/sda output.img output.mapfile

# Add retries for stubborn sectors
ddrescue -r3 --cpass=1,3-4 /dev/sda output.img output.mapfile

Try without -r during the first run, to not hammer the bad sectors, after a full read re-run with retries.

Scenario 4: Working with Unknown Drive Sizes

Sometimes you need to calculate sizes dynamically:

input_size=500123456789
start=199000000000
ddrescue -i$start -s$(($input_size - $start)) /dev/sda output.img output.mapfile

Advanced Recovery Strategy

My recommended approach for recovering data from a failing drive.

First Pass - Quick Recovery
```
ddrescue -n /dev/sda output.img output.mapfile
```
The -n flag skips the scraping phase, quickly getting the easy-to-read sectors.
Second Pass - Retry Bad Sectors
```
ddrescue -r3 /dev/sda output.img output.mapfile
```
Now we retry bad sectors up to 3 times.
Third Pass - Direct Access
```
ddrescue -d -r3 /dev/sda output.img output.mapfile
```
Using direct disk access as a last resort.

Understanding the Recovery Phases

ddrescue operates in multiple phases:

1. Copying Phase (Up to 5 passes)

Pass 1: Quick read of good sectors
Pass 2: Delimits bad blocks
Pass 3-4: Handles slow areas
Pass 5: Final sweep

2. Trimming Phase

Precisely identifies boundaries of bad sectors
Works from both ends of bad blocks
Marks sectors as either bad or non-scraped

3. Scraping Phase

Attempts recovery of non-scraped blocks
Works sector by sector
Marks permanent failures

4. Retrying Phase

Optional phase (enabled with -r)
Repeatedly attempts bad sectors
Reverses direction between attempts

Working with the Recovered Image

After recovery, you can mount the image read-only:

mount -o ro,loop output.img /mnt/recovery

Tips

Always start without retries
```
ddrescue -n /dev/sda output.img output.mapfile
```
This gets the easy data first before stressing the drive with retries.
Use direct access (if the Linux blockdev layer is locking up)
```
ddrescue -d /dev/sda output.img output.mapfile
```
Direct access can be faster but might not work on all systems.
Consider reverse direction
```
ddrescue --reverse /dev/sda output.img output.mapfile
```
Sometimes reading backwards can help with certain types of damage.
Monitor progress
```
ddrescue -v /dev/sda output.img output.mapfile
```
The -v flag provides detailed progress information.

The tool’s sophisticated multi-phase approach and ability to resume interrupted operations make it invaluable for data recovery. Whether you’re dealing with a failing drive, a corrupted partition, or just need to make a perfect copy of a device, ddrescue should be in your toolkit.