Forbid Effect City

GNU DDRescue: The Ultimate Data Recovery Tool

GNU ddrescue stands as one of the most powerful and reliable data recovery tools available for Linux systems. This comprehensive guide explores its capabilities, usage techniques, and best practices to help you successfully recover data from failing storage devices.

What is GNU DDRescue?

GNU ddrescue is a sophisticated data recovery tool designed to copy data from one file or block device (such as hard disks, CD-ROMs, or memory sticks) to another, with a focus on rescuing good data first in case of read errors. Unlike standard copying tools, ddrescue employs an intelligent algorithm that prioritizes recovering accessible data before attempting more challenging areas.

It's important to note that GNU ddrescue should not be confused with dd_rescue, which is an entirely different tool with different syntax and capabilities.

Key Features

  • Fully automatic operation - no need to manually restart the program when errors are encountered
  • Efficient data recovery through the use of mapfiles
  • Non-destructive approach - doesn't write zeros to unreadable sectors
  • Resume capability - allows interruption and continuation of recovery operations
  • Automatic merging of backups from multiple damaged copies

Installation

GNU ddrescue is available in most Linux distribution repositories. Here's how to install it on major distributions:

Ubuntu, Debian, and Linux Mint

sudo apt install gddrescue

Fedora, CentOS, AlmaLinux, and Red Hat

sudo dnf install ddrescue

Arch Linux and Manjaro

sudo pacman -S ddrescue

Basic Usage

The basic syntax for using ddrescue is:

ddrescue [options] infile outfile [mapfile]

Where:

  • infile is the source device or file (e.g., /dev/sda)
  • outfile is the destination (e.g., recovered.img or another device)
  • mapfile tracks recovery progress (strongly recommended)

Essential Command Examples

Basic Recovery to an Image File

ddrescue -f -n /dev/sdb /root/sdb_rescue.img /root/rescue.log

This command performs an initial pass without spending time on difficult sectors (-n) and forces writing to the output file even if it already exists (-f).

Recovering Only the Bad Blocks

After the initial pass, you can focus on problematic areas:

ddrescue -d -r3 /dev/sdb /root/sdb_rescue.img /root/rescue.log

This attempts to recover bad blocks by retrying up to 3 times (-r3) and uses direct disk access (-d).

Understanding the Mapfile System

The mapfile (previously called logfile in versions prior to 1.20) is a critical component of ddrescue's effectiveness. It allows ddrescue to:

  1. Track which blocks have been read successfully
  2. Resume operations if interrupted
  3. Focus on problematic areas in subsequent runs
  4. Avoid rereading already recovered data

Mapfile Structure

The mapfile consists of three parts:

  1. Heading comments - Contains version information and timestamps
  2. Status line - Shows current operation and position
  3. List of data blocks - Details the status of each block

Status Characters in the Block List

Character Meaning
? Non-tried block
* Failed block non-trimmed
/ Failed block non-scraped
- Failed block with bad sector(s)
+ Finished block

Example Mapfile

# Mapfile. Created by GNU ddrescue version 1.27
# Command line: ddrescue -d -c18 /dev/fd0 fdimage mapfile
# Start time: 2015-07-21 09:37:44
# Current time: 2015-07-21 09:38:19
# Copying non-tried blocks... Pass 1 (forwards)
# current_pos current_status current_pass
0x00120000 ? 1
# pos size status
0x00000000 0x00117000 +
0x00117000 0x00000200 -
0x00117200 0x00001000 /
0x00118200 0x00007E00 *
0x00120000 0x00048000 ?

Advanced Recovery Techniques

Multi-Phase Recovery Strategy

For optimal results, use a multi-phase approach to data recovery:

  1. First pass (-n option): Quick copy of all easily readable blocks
ddrescue -f -n /dev/sdb recovery.img mapfile
  1. Second pass (retrying): Focus on problematic areas with retries
ddrescue -d -r3 /dev/sdb recovery.img mapfile
  1. Reverse direction (optional): Approach bad sectors from the opposite direction
ddrescue -d -R -r3 /dev/sdb recovery.img mapfile

Dealing with Extremely Damaged Media

For heavily damaged media, consider these advanced techniques:

  1. Reducing cluster size to improve recovery of small good areas:
ddrescue -d -c 1024 /dev/sdb recovery.img mapfile
  1. Setting maximum error rate to prevent wear on dying drives:
ddrescue -E 10k /dev/sdb recovery.img mapfile
  1. Setting minimum read rate to quickly skip severely damaged areas:
ddrescue -a 10k /dev/sdb recovery.img mapfile

Performance Optimization and Troubleshooting

Speed Optimization

Users often wonder how to speed up ddrescue, especially when processing large drives with many errors. Some effective approaches include:

  • Use the -n (no-split) option for the first pass to avoid time-consuming splitting operations
  • Set smaller cluster sizes (-c option) to improve efficiency on drives with many errors
  • Use direct disk access (-d option) to bypass system cache for potentially faster reads
  • Limit retries to avoid spending excessive time on severely damaged sectors

Expected Duration

Data recovery with ddrescue can be extremely time-consuming, especially for drives with many errors. A recovery process can take:

  • A few hours for drives with few errors
  • Several days for heavily damaged drives
  • Up to weeks for very large drives with extensive damage

The recovery rate typically slows significantly during the trimming and splitting phases as ddrescue focuses on problematic areas.

Real-world Applications

Scenario 1: Rescuing Data from a Failing Hard Drive

  1. Create a full disk image first (safer than direct operations)
ddrescue -f /dev/sda disk_image.img mapfile
  1. Mount the recovered image to extract files
mount -o ro,loop disk_image.img /mnt/recovery

Scenario 2: Repairing File Systems Using Bad Block Lists

For ext2/ext3/ext4 file systems, you can use ddrescue in combination with e2fsck:

  1. Rescue the partition
ddrescue -f /dev/sda1 /dev/sdb1 mapfile1
  1. Generate bad block list
ddrescuelog -l- -b4096 mapfile1 > badblocks1
  1. Repair file system with bad block awareness
e2fsck -v -f -L badblocks1 /dev/sdb1

Scenario 3: Working with Disk Images

To mount a recovered disk image for file extraction:

hdiutil attach output.img -shadow output.shadow

Best Practices and Safety Precautions

To ensure successful data recovery and prevent further damage:

  1. Never write to the source drive - always recover to a different drive or image file
  2. Unmount all partitions before running ddrescue
  3. Check drive health with smartmontools before starting recovery
  4. Ensure sufficient destination space - at least as large as the source device
  5. Always use a mapfile to enable resuming operations if interrupted
  6. Allow tools to finish completely - interrupting can cause additional problems
  7. Don't run tools on mounted partitions to prevent file system corruption

Conclusion

GNU ddrescue remains one of the most powerful and reliable tools for data recovery on Linux systems. Its intelligent approach to prioritizing good data recovery, combined with the mapfile system for tracking progress, makes it exceptionally effective even in challenging recovery scenarios.

For users facing potential data loss, ddrescue offers hope when commercial solutions might be prohibitively expensive or unavailable. While its command-line interface might seem intimidating at first, the systematic approach outlined in this guide should help users successfully recover their valuable data.

Remember that prevention is always better than recovery - maintain regular backups of important data to avoid the stress and uncertainty of data recovery operations.

Back to Home