0

I'm trying to recover data from a disk with multiple corrupted sectors. Damaged partition (Windows partition, sdb2) s no longer mountable (it takes a lot of time, and sometimes makes Ubuntu file explorer crash/everything get laggy), so I tried to use ddrescue to recover its data.

I formatted another disk (2 times bigger than damaged partition) as FAT (sda1) and intended to use it as a rescue disk.

I run this command :

sudo ddrescue -B -v -n --force /dev/sdb2 /dev/sda1 récupérationLog2.log

After 9 hours of intense work, the console output seems pretty nice as it mentions 953525 MiB of data rescued (on a 1TB partition):

*GNU ddrescue 1.19
About to copy 953668 MiBytes from /dev/sdb2 to /dev/sda1.
    Starting positions: infile = 0 B,  outfile = 0 B
    Copy block size: 128 sectors       Initial skip size: 128 sectors
Sector size: 512 Bytes
Press Ctrl-C to interrupt
rescued:  953525 MiB,  errsize:   142 MiB,  current rate:     3072 B/s
   ipos:  904228 MiB,   errors:     513,    average rate:  29903 KiB/s
   opos:  904228 MiB, run time:    9.07 h,  successful read:       0 s ago
Finished*

Everything seems pretty good, but when I mount the rescue partition, sda1, it seems there is no file at all. Everything is empty. Of course it tried to list hidden files with ls -a, but there's nothing there.

That's the second times I get what seems to be a pretty successful recovery without getting any output files. Is there anything I did wrong or anything else to try?

Excerpt of logFile

# Rescue Logfile. Created by GNU ddrescue version 1.19
# Command line: ddrescue -B -v -n --force /dev/sdb2 /dev/sda1 récupérationLog2.log
# Start time:   2017-04-18 09:47:59
# Current time: 2017-04-18 18:52:11
# Finished
# current_pos  current_status
0xDCC247D000     +
#      pos        size  status
0x00000000  0x0160C000  +
0x0160C000  0x00000200  -
0x0160C200  0x02B5FC00  /
0x0416BE00  0x00000200  -
0x0416C000  0x14B94000  +
0x18D00000  0x00000200  -
0x18D00200  0x003FFC00  /
0x190FFE00  0x00000200  -
0x19100000  0x4F570000  +
0x68670000  0x00000200  -
0x68670200  0x00005C00  /
0x68675E00  0x00000200  -
0x68676000  0x00094000  +
0x6870A000  0x00000200  -
0x6870A200  0x00001C00  /
0x6870BE00  0x00000200  -
0x6870C000  0x008E0000  +
0x68FEC000  0x00000200  -
0x68FEC200  0x00002C00  /
0x68FEEE00  0x00000200  -
0x68FEF000  0x0000A000  +
0x68FF9000  0x00000200  -
0x68FF9200  0x00006C00  /
0x68FFFE00  0x00000200  -

I had to add the argument --force cause every time I tried to use ddrescue it said it could not start due to ouputlog file already exists even if I tried a different, non-existent file name each time.

karel
  • 114,770
Nicolas D
  • 1
  • Did you read / follow the GNU ddrescue Manual? And the original drive wasn't mountable before right, did you have to do anything to fix it, run fsck or similar? I can't read the logfile, but there is ddrescueview in the ubuntu repos for a neat GUI – Xen2050 Apr 19 '17 at 09:19
  • Did you try to mount /dev/sda1? – d a i s y Apr 19 '17 at 09:23
  • thanks for commenting ! I read some other ddrescue tutorial before trying to use ddrescue, but I'll read what you linked which seems to be the official manual. – Nicolas D Apr 19 '17 at 09:26
  • as the original partition was non moutable, I just tried to repair SMART state, but it seems not to have any effect.

    Once rescue was finished, I mounted /dev/sda1 (ouput partition), but it seems there is nothing there (not even hidden files)

     – Nicolas D Apr 19 '17 at 09:27
  • Damaged partition is windows partition /dev/sdb2, right? what is size of it? and `/dev/sda1, is it your external harddrive? What size of it? – d a i s y Apr 19 '17 at 09:32
  • exactly, sdb2 is the damaged partition, and sda1 is fresh FAT partition from another internal disk – Nicolas D Apr 19 '17 at 09:38
  • ddrescueview, opening logfile, seems to say that rescue is finished and that 999.84GB of data has been rescued out of 999.99GB of data, with 520.70KB bad sectors and 1017 error count – Nicolas D Apr 19 '17 at 09:41
  • Your disk /dev/sdb has two os ubuntu and windows, then how windows partition has 999.84GB of data. It should be size of /dev/sdb2. – d a i s y Apr 19 '17 at 09:49
  • Here's an overview of disk map :
    • sda (rescue disk) with sda1 Fat partition of 2 TB

    -sdb (damaged disk) with sdb1 (210MB efi windows partition) and sdb2 (1Tb damaged windows partition containing the data I would like to recover)

    -sdc which contains my linux OS on a an ext4 partition sdc1

     – Nicolas D Apr 19 '17 at 09:50
  • I miss clicked :) I edited previous comment – Nicolas D Apr 19 '17 at 09:55
  • okay..not extending further question. In my case 100 GB of ubuntu installed partition /dev/sdb1 corrupted and i've used 160 GB of fresh installed ubuntu drive/dev/sda1 to recover it with: sudo ddrescue -r 3 -C /dev/sdb1 /media/username/e205d787-b94e-49c5-86ca-90d122cbe90a/home/username/recoverdata.img and then mount that image file. In my case /dev/sda1/ mounted on/media/username/e205d787-b94e-49c5-86ca-90d122cbe90a See: DataRecovery – d a i s y Apr 19 '17 at 10:02
  • 1
    Have you considered using Testdisk and PhotoRec to recover data from the cloned copy? – sudodus Apr 19 '17 at 10:55
  • 1
    The damage of the original partition is the main reason you can't read it. The error has likely been copied over to the rescue partition so it is of little surprise that it can't be read. Use testdisk on the rescued clone but you will have no luck if the original partition was encrypted. – Takkat Apr 19 '17 at 11:19
  • 1
    I'm currently using testdisk to recreate an img file of the damaged partition and will keep you posted guys ! thanks for your support :) – Nicolas D Apr 19 '17 at 12:25
  • After having spent 9h trying to rescue sdb2 to an image.dd, I mounted this image.dd using this kind of command :

    sudo mount -o loop -t auto /media/nicolas/ext/backup/image.dd /mnt/disk_image

    image.dd seems to be properly mounted on disk_image, but, as usual, not any data (checked with ls -a).

    any idea of why ?

    Thanks for your support !

     – Nicolas D Apr 20 '17 at 08:20
  • PS: the volume mounted from the dd image (~1TB), looks really empty as the volume show a few kB of space on disk...

    Another person already tried rescuing data from this disk before me, is there any chance all data were removed in the process, explaining why both ddrescue and testdisk succesfully rescue 99% of the disk, which provide 0 file ?

     – Nicolas D Apr 20 '17 at 09:53
  • There is such a risk but I still think that there are lots of data to be recovered :-) at least with PhotoRec. – sudodus Apr 21 '17 at 16:44

1 Answers1

1

I formatted another disk (2 times bigger than damaged partition) in FAT (sda1)

[...]

sudo ddrescue -B -v -n --force /dev/sdb2 /dev/sda1 récupérationLog2.log

This is not how it works. Here's what you are doing now:

  • You are copying the contents of /dev/sdb2 over /dev/sda1
  • You have marked the latter as FAT in the partition table, but you are overwriting with a NTFS file system
  • When you try to "mount" /dev/sda1 it doesn't work because that is not a FAT file system, of course

As a side note, using mount for data recovery is rarely a good approach especially if you don't ensure it is read-only. Also, don't add accents or special characters to file names in the terminal.

What you should've done instead is:

  • Create a new partition to hold an image file of the failing partition. Note that FAT is not an acceptable choice because you cannot store FAT files which are larger than 4GB. NTFS or exFAT would be OK.

  • Mount said partition and copy the drive into a file, e.g.:

    ddrescue /dev/sdb2 /media/user/External/copy.img /media/user/External/copy.log

  • Perform data recovery on the copy as explained in Recovering broken or deleted NTFS partitions

Andrea Lazzarotto
  • 7,956