## 11 A small tutorial with examples ¶

This tutorial is for those already able to use the dd command. If you don’t know what dd is, better search the net for some introductory material about dd and GNU ddrescue first.

A failing drive tends to develop more and more errors as time passes. Because of this, you should rescue the data from a drive as soon as you notice the first error. Be diligent because every time a physically damaged drive powers up and is able to output some data, it may be the very last time that it ever will.

You should make a copy of the failing drive with ddrescue, and then try to repair the copy. If your data are really important, use the first copy as a master for a second copy, and try to repair the second copy. If something goes wrong, you have the master intact to try again.

If you are trying to rescue a whole partition, first repair the copy with e2fsck or some other tool appropriate for the type of partition you are trying to rescue, then mount the repaired copy somewhere and try to recover the files in it.

If the drive is so damaged that the file system in the rescued partition can’t be repaired or mounted, you will have to browse the rescued data with an hex editor and extract the desired parts by hand, or use a file recovery tool like photorec.

If the partition table is damaged, you may try to rescue the whole disc, then try to repair the partition table and the partitions on the copy.

If the damaged drive is not listed in `/dev`, then you cannot rescue it. At least not with ddrescue.

See Copying CD-ROMs and DVDs, for rescue examples of CD-ROMs and DVDs.

Example 1: Fully automatic rescue of a whole disc with two ext2 partitions in `/dev/sda` to `/dev/sdb`.
Note: you don’t need to partition `/dev/sdb` beforehand, but if the partition table on `/dev/sda` is damaged, you’ll need to recreate it somehow on `/dev/sdb`.

    ddrescue -f -r3 /dev/sda /dev/sdb mapfile
    fdisk /dev/sdb
    e2fsck -v -f /dev/sdb1
    e2fsck -v -f /dev/sdb2

Example 2: Rescue an ext2 partition in `/dev/sda2` to `/dev/sdb2`.
Note: you need to create the partition sdb2 with fdisk first. sdb2 should be of appropriate type and size.

    ddrescue -f -n /dev/sda2 /dev/sdb2 mapfile
    ddrescue -d -f -r3 /dev/sda2 /dev/sdb2 mapfile
    e2fsck -v -f /dev/sdb2
    mount -t ext2 -o ro /dev/sdb2 /mnt
      (read rescued files from /mnt)

Example 3: While rescuing the whole drive `/dev/sda` to `/dev/sdb`, `/dev/sda` freezes up at position 12_345_678.

    ddrescue -f /dev/sda /dev/sdb mapfile         # /dev/sda freezes here
      (restart /dev/sda or reboot computer)
      (restart copy at a safe distance from the troubled sector)
    ddrescue -f -i 12350000 /dev/sda /dev/sdb mapfile
      (then copy backwards down to the troubled sector)
    ddrescue -f -R /dev/sda /dev/sdb mapfile

Example 4: While rescuing the whole drive `/dev/sda` to `/dev/sdb`, `/dev/sdb` fails and you have to rescue the data to a third drive, `/dev/sdc`.

    ddrescue -f -n /dev/sda /dev/sdb mapfile1       # /dev/sdb fails here
    ddrescue -f -m mapfile1 /dev/sdb /dev/sdc mapfile2
    ddrescue -f -n /dev/sda /dev/sdc mapfile2
    ddrescue -d -f -r3 /dev/sda /dev/sdc mapfile2

Example 5: While rescuing a partition in `/dev/sda1` to the file `hdimage`, `/dev/sda1` stops responding and begins returning read errors, causing ddrescue to mark the rest of the partition as non-scraped.

    ddrescue -n /dev/sda1 hdimage mapfile          # /dev/sda1 fails here
      (restart /dev/sda or reboot computer)
    ddrescue -n -A -i<pos> -O /dev/sda1 hdimage mapfile
      (if /dev/sda1 fails again, restart /dev/sda or reboot computer and
       then repeat the above command as many times as needed until it
       succeeds. <pos> is the position where the drive stopped responding)
    ddrescue -d -r3 /dev/sda1 hdimage mapfile

Example 6: While rescuing a partition in `/dev/sda1` to the file `hdimage`, sda1 disappears from `/dev`.

    ddrescue -n /dev/sda1 hdimage mapfile          # /dev/sda1 fails here
      (restart /dev/sda or reboot computer and then repeat the above
       command as many times as needed until it succeeds)
    ddrescue -d -r3 /dev/sda1 hdimage mapfile

Example 7: While rescuing a partition in `/dev/sda1` to the file `hdimage`, the partition table of `/dev/sda` becomes unreadable and the OS no longer shows sda1 in `/dev`. The solution is to shift the mapfile and read the rest of the partition sda1 from `/dev/sda`.
Note: you need to know the offset of the partition sda1 in the drive sda and the size of sda1.

    ddrescue /dev/sda1 hdimage mapfile       # partition table fails here
    ddrescuelog --shift -o<offset> mapfile > shifted_mapfile
    ddrescue -i<offset> -o0 -s<size> /dev/sda hdimage shifted_mapfile

Example 8: After rescuing a partition in `/dev/sda1` to the file `hdimage`, expand `hdimage` to copy the whole drive in `/dev/sda` without recopying the already copied partition `/dev/sda1`. The solution is to shift the mapfile, move the data of sda1 to its final position in `hdimage`, and then read the rest of the data from `/dev/sda`.
Note: you need to know the offset of the partition sda1 in the drive sda and the size of sda1.

    ddrescue /dev/sda1 hdimage mapfile             # rescue partition
    ddrescuelog --shift -o<offset> mapfile > shifted_mapfile
    ddrescue --same-file -o<offset> -s<size> --reverse hdimage hdimage
    ddrescue /dev/sda hdimage shifted_mapfile      # rescue rest of drive

Example 9: Recover a collection of photos from a damaged external drive (`/dev/sdc1`). The photos are protected with forward error correction (fec) files created by lziprecover. The photos are in directory `photos`, and the fec files are in directory `photos-fec`.

    ddrescue -b4096 -r10 /dev/sdc1 hdimage mapfile
    mount -o loop,ro hdimage /mnt/hdimage
    cp -a /mnt/hdimage/photos photos
    cp -a /mnt/hdimage/photos-fec photos-fec
    umount /mnt/hdimage
    lziprecover -v -Fr --fec-file=photos-fec/ photos/*
      (Check and rename repaired files. They are named photos/*_fixed)

Example 10: Recover a damaged tar.lz backup using the recovery record appended to the backup itself. The damaged backup comes from a damaged partition copied with ddrescue.

    ddrescue -b4096 -r10 /dev/sdc1 hdimage mapfile
    mount -o loop,ro hdimage /mnt/hdimage
    cp /mnt/hdimage/backup.tar.lz backup.tar.lz
    umount /mnt/hdimage
    lzip -t backup.tar.lz
      backup.tar.lz: Decoder error at pos 1_020_530
    lziprecover --dump=tdata backup.tar.lz | \
      lziprecover -v -Fr --fec-file=- backup.tar.lz

Example 11: Recover a damaged tar.lz backup with a zeroed sector of 4096 bytes at file position 1_019_904, using as reference a previous backup. The damaged backup comes from a damaged partition copied with ddrescue.

    ddrescue -b4096 -r10 /dev/sdc1 hdimage mapfile
    mount -o loop,ro hdimage /mnt/hdimage
    cp /mnt/hdimage/backup.tar.lz backup.tar.lz
    umount /mnt/hdimage
    lzip -t backup.tar.lz
      backup.tar.lz: Decoder error at pos 1_020_530
    lziprecover -vv -e --reference-file=old_backup.tar backup.tar.lz
    Reproducing bad area in member 1 of 1
      (begin = 1_019_904, size = 4096, value = 0x00)
      (master mpos = 1_019_903, dpos = 5_857_954)
    warning: old_backup.tar: Partial match found at offset 5_743_778, len 9546
    Reference data may be mixed with other data.
    Trying level -9
      Reproducing position 1_015_808
    Member reproduced successfully.
    Copy of input file reproduced successfully.