1

I'm using the foremost,photorec and other tools for recovering data.

What is the best way for cloning the USD or HDD for recovery files?

  • Which one should I use dd or cat or ddrescue?
  • If you recommended to use dd, then how should I use it for carving?
  • Try recovery files of image cloned, is equivalent to try recovery directly to the device?
Milor123
  • 231
  • 1
    For rescue operations I would recommend ddrescue, particularly if you suspect that there are bad sectors (physical damage). See this link and links from it: 'Repair the partition table and file system of a pendrive', https://ubuntuforums.org/showthread.php?t=2196858&p=13409986#post13409986 , browse to the paragraph ' Advanced repair of a partition table, file system and/or recovery of files' – sudodus Jan 26 '17 at 20:28
  • 1
    Carving is the last resort anyway. You should use proper tools for cloning drives (dd is the bare minimum, but ddrescue or dcfldd are definitely better) then start working on data extraction. – Andrea Lazzarotto Jan 27 '17 at 16:35
  • Thank you very much @sudodus and Andrea Lazarotto... and assuming that usb is only media drive, what should I use dd or ddrescue? I want recovery files – Milor123 Jan 27 '17 at 18:49
  • 1
    I suggest again ddrescue for this cloning task. And then you can use various tools on the cloned copy in order to recover files, for example testdisk to recover the partition structure and file system, and if it fails, photorec, that can recover files without any file system. See the link in my first comment and also the following links, https://askubuntu.com/questions/870462/i-unplugged-an-sd-card-without-clicking-eject-and-now-everything-is-read-only/870555#870555 , https://askubuntu.com/questions/862224/how-can-i-get-back-the-data-of-my-usb-on-ubuntu-16-04-1-lts/862227#862227 – sudodus Jan 27 '17 at 19:34
  • And yes, when cloned, all data are the same on the source and target. If you want to play safe, you can clone with mkusb, which helps you select the target drive (so that you avoid a disaster). mkusb uses dd under the hood, but if you check and double-check, it should work well with ddrescue. You can ask here, if the command line you intend to use is good or bad, and wait for a reply before you use it. – sudodus Jan 27 '17 at 19:46
  • Thank very much dude @sudodus should put it like answered – Milor123 Jan 27 '17 at 19:51

1 Answers1

3

Used correctly, dd can copy every byte on a volume. Contrariwise, cat will only copy the contents of files. Obviously, dd is the better choice when data not included in files is of importance.

Zeiss Ikon
  • 5,128
  • Well, cat can also write to block devices, like dd, and it will be as dangerous, because it does what you tell it to do without questions: sudo bash -c 'cat mini.iso > /dev/sdx' where x is the target device. But dd can be modified to select 'chunks' in a flexible way, so that I would prefer it to cat, but I think ddrescue is even better. But remember that all these tools are dangerous - you can easily write to the wrong drive and overwrite valuable data. – sudodus Jan 27 '17 at 08:44
  • And cat can read from a block device and write to an image file as described in the following command line: sudo bash -c '< /dev/sdd cat > testfile.img' . But I still agree that dd is better for the purpose of this question. If you want a safer method you can clone the drive with mkusb. It will help you select the target drive in a way that 'wraps security around dd', https://help.ubuntu.com/community/mkusb – sudodus Jan 27 '17 at 09:03