Help with DDRescue

[Majestic]

Hi all,

I'm trying to MOUNT with ddrescue (First time using it and following youtube video).. two drives so I can clone a bad 2 TB drive to a good one.

anyway I go to mount /dev/sdb1 /mnt (in this case the new drive) as was identified by fdisk -l. That works.

However Fdisk -l also said WARNING: GPT detected on /dev/sdb - use GNU parted - for the bad disk I believe (currently with no partition at all).

The "bad" disk shows uninitialized in windows disk manager however I've made some progress using getdataback. That said, I want to perform a proper clone of it but ddrescue has not been very cooperative in mounting it.

Any help would be greatly appreciated.

Thanks

Majestic

 

[lcoughey]

First off, you don't want to mount either of the drives if you are doing a drive to drive clone. Can you also confirm that there is nothing on the "good" drive and that it is 100% zeroed out? If there is existing data on the drive, it will not get overwritten by running ddrescue where there are bad sectors that are skipped from the source.

Just be 100% sure you know which drive is which and run this command:

ddrescue -F {source} {dest} {logfile}

If you want to boot off my remote support CD, we could do it for you for $50.

 

[Majestic]

First off, you don't want to mount either of the drives if you are doing a drive to drive clone. Can you also confirm that there is nothing on the "good" drive and that it is 100% zeroed out? If there is existing data on the drive, it will not get overwritten by running ddrescue where there are bad sectors that are skipped from the source.

Just be 100% sure you know which drive is which and run this command:

ddrescue -F {source} {dest} {logfile}

If you want to boot off my remote support CD, we could do it for you for $50.

I can confirm the drive has been reformatted and nothing is on it but it has not been zeroed out.

I will try the command, much appreciated! Please let me know if there are any issues with the "new" drive not being zeroed out and simply formatted.

Regards,

Majestic

 

[coffee]

You might also be interested in using "clonezilla" which is a bootable cd that will clone one drive/partition to another drive or backup to an image file. It will skip bad sectors in expert mode also.

 

[Majestic]

You might also be interested in using "clonezilla" which is a bootable cd that will clone one drive/partition to another drive or backup to an image file. It will skip bad sectors in expert mode also.

The reason I want to use ddrescue is because it intelligently refills the data rather than skips it.

Majestic

 

[lcoughey]

If you don't zero it out, any sectors that are skipped are going to hold the information from whatever was on the drive before. So, when you run a program like GDB, you are going to get a tainted recovery.

So, when done, you will want to zero out any sectors that haven't been read from the clone. I haven't actually ever done this...I always use blank destination drives for my clones, but it should work.

ddrescue -F -r1 /dev/zero {dest} {logfile}

As the log file does not confirm that you are using the same source, it will simply write zeros to any sector that hasn't been read.

Again, be very careful that you are going in the correct direction. A small mistake during this process will lose everything and nobody will get it back.

 

[Majestic]

If you don't zero it out, any sectors that are skipped are going to hold the information from whatever was on the drive before. So, when you run a program like GDB, you are going to get a tainted recovery.

So, when done, you will want to zero out any sectors that haven't been read from the clone. I haven't actually ever done this...I always use blank destination drives for my clones, but it should work.

ddrescue -F -r1 /dev/zero {dest} {logfile}

As the log file does not confirm that you are using the same source, it will simply write zeros to any sector that hasn't been read.

Again, be very careful that you are going in the correct direction. A small mistake during this process will lose everything and nobody will get it back.

I verified 5 times (I'm that paranoid) that it was the right direction.

I hope the zeroing doesn't take too long.. the thing is the source drive is already not seen in Windows as "unitialized disk." My plan is to rebuild the mbr once it's been cloned using something like test disk and/or try to get back the data using getdataback. Will the zeroing take very much time? And should I do that immediately after the clone? (It won't erase the already cloned data right ? Since it's not "seen")

Regards,

Majestic

 

[SilverLeaf]

However Fdisk -l also said WARNING: GPT detected on /dev/sdb - use GNU parted - for the bad disk I believe (currently with no partition at all).
Majestic

Just a note:
fdisk does NOT support GPT disks. Use GPT fdisk instead if you need to work on GPT disks. It is available for Windows and should be readily available in the repositories of most linux distos. Parted Magic and System Rescue CD both have GPT fdisk included.

 

[Metanis]

DD Rescue command lines

These are some notes I wrote to myself regarding Linux tools for cloning disks. Some of it doesn't seem to work in every case.

1. Mostly based on the Ubuntu Rescue Remix CD http://www.ubuntu-rescue-remix.org/

2. sudo lshw -C Disk -short (Gives you a list of disk devices and their Linux names like /dev/sda)

3` Try the sudo mount command before the next step to see if it will automount your flash drive...

3. sudo mkdir /mnt/usb0
sudo mount -t ntfs /dev/sdc /mnt/usb0

(This combination of commands creates a logical device so you can mount a flash key in order to save a log file -- this step is OPTIONAL)

4. sudo ddrescue -f -r3 -v /dev/sda /dev/sdb /mnt/usb0/somerescue.log (the -f option may not work!)

Clones drive A to drive B while maintaining a log file on the flash drive mounted earlier.
-f = force Force overwrite of output file. Needed when the output file is not a regular file, but a device or partition.
-r3 = 3 retries on bad data
-v = show version in log file

When ddrescue has copied the entire drive it will come back and retry the bad areas. It copies sector-by-sector which is very slow but good for
maximum data retention and forensics.

See the manual at http://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html

5. sudo -s

Supposed to give you permanent root access

 

[Majestic]

These are some notes I wrote to myself regarding Linux tools for cloning disks. Some of it doesn't seem to work in every case.

1. Mostly based on the Ubuntu Rescue Remix CD http://www.ubuntu-rescue-remix.org/

2. sudo lshw -C Disk -short (Gives you a list of disk devices and their Linux names like /dev/sda)

3` Try the sudo mount command before the next step to see if it will automount your flash drive...

3. sudo mkdir /mnt/usb0
sudo mount -t ntfs /dev/sdc /mnt/usb0

(This combination of commands creates a logical device so you can mount a flash key in order to save a log file -- this step is OPTIONAL)

4. sudo ddrescue -f -r3 -v /dev/sda /dev/sdb /mnt/usb0/somerescue.log (the -f option may not work!)

Clones drive A to drive B while maintaining a log file on the flash drive mounted earlier.
-f = force Force overwrite of output file. Needed when the output file is not a regular file, but a device or partition.
-r3 = 3 retries on bad data
-v = show version in log file

When ddrescue has copied the entire drive it will come back and retry the bad areas. It copies sector-by-sector which is very slow but good for
maximum data retention and forensics.

See the manual at http://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html

5. sudo -s

Supposed to give you permanent root access

I will put this in my notes as well and try the Ubuntu Rescue Disk. Right now I'm using the System Rescue CD 3.4.0.

Thanks!

Majestic

 

[Vicenarian]

This might also come in handy:

http://technibble.com/forums/showthread.php?t=43930&highlight=rescue

 

[lcoughey]

It should be noted that if you run into any sort of issues and the drive starts to make any noises, you need to recognize that the drive will continue to degrade and may completely crash before you complete the mirror, at which point the cost to recover the data at a lab may be considerably more, if recoverable at all.

 

[Majestic]

This might also come in handy:

http://technibble.com/forums/showthread.php?t=43930&highlight=rescue

It does, thanks..

mann... It's copying at 43690 B/second.. It'll take about 7 days for this to complete more than I'm willing to wait. Perhaps I will let it go until tonight and then if it's still the same thing I will put the drive in the freezer and see if that helps!!

Majestic

 

[lcoughey]

It does, thanks..

mann... It's copying at 43690 B/second.. It'll take about 7 days for this to complete more than I'm willing to wait. Perhaps I will let it go until tonight and then if it's still the same thing I will put the drive in the freezer and see if that helps!!

Majestic

That is a sure sign that there is more issues than a few bad sectors. Now is the time to let the client decide whether you outsource to a professional lab or if you keep moving forward.

 

[Majestic]

It should be noted that if you run into any sort of issues and the drive starts to make any noises, you need to recognize that the drive will continue to degrade and may completely crash before you complete the mirror, at which point the cost to recover the data at a lab may be considerably more, if recoverable at all.

After reading this and reconsidering I've disconnected the drive and I'm letting it cool down (in the freezer) and I will reconnect it and see if I have better success.

..definitely need to explain the time factor to the client.

Majesitc

 

[Metanis]

Yes, one of the major "features" or "flaws" of DDRescue is that it does a sector-by-sector copy of each and every sector on the hard drive. It takes a LONG time especially if the drives are large. I suspect around 24 hours for your 2TB drives. However it IS a feature if you are patient and want to ensure the highest amount of data transfer including deleted or damaged bits. As mentioned, if the suspected 'bad' drive has a thermal issue it will only get worse as the copy continues. I've set drives on a piece of sheet metal for thermal conductivity and a big fan blowing across it to keep it close to room temperature.

 

[lcoughey]

After reading this and reconsidering I've disconnected the drive and I'm letting it cool down (in the freezer) and I will reconnect it and see if I have better success.

..definitely need to explain the time factor to the client.

Majesitc

So, by putting in the freezer, what are you trying to accomplish? Does your client your client know that you are risking losing their data?

 

[Majestic]

Yes, one of the major "features" or "flaws" of DDRescue is that it does a sector-by-sector copy of each and every sector on the hard drive. It takes a LONG time especially if the drives are large. I suspect around 24 hours for your 2TB drives. However it IS a feature if you are patient and want to ensure the highest amount of data transfer including deleted or damaged bits. As mentioned, if the suspected 'bad' drive has a thermal issue it will only get worse as the copy continues. I've set drives on a piece of sheet metal for thermal conductivity and a big fan blowing across it to keep it close to room temperature.

Well the thing is the drive is choking and I can hear it as it struggles. I'm scared that it will die. In the past I have put drives in the freezer then made a quick clone or a quick copy and have been successful. Based on the copy speed ddrescue had listed I could imagine it going a week or two if not longer. Maybe I'm wrong? It had only copied a few megs in an hour so 2TB may not happen. Really depends what kind of shape the drive is in I guess.

I could always send it to 300ddr.. not sure if my client would agree to spending my time and another $500+ on it though..

Majestic

 

[lcoughey]

Well the thing is the drive is choking and I can hear it as it struggles. I'm scared that it will die. In the past I have put drives in the freezer then made a quick clone or a quick copy and have been successful. Based on the copy speed ddrescue had listed I could imagine it going a week or two if not longer. Maybe I'm wrong? It had only copied a few megs in an hour so 2TB may not happen. Really depends what kind of shape the drive is in I guess.

I could always send it to 300ddr.. not sure if my client would agree to spending my time and another $500+ on it though..

Majestic

Up to this point, your client shouldn't pay anything for the recovery attempt, as you haven't successfully recovered their data.

 

[Majestic]

Up to this point, your client shouldn't pay anything for the recovery attempt, as you haven't successfully recovered their data.

Actually I have recovered quite a bit using getdataback. I just have not recovered the last and most important directory which is 142 gigs approx. I'll have to just negotiate a fair agreement that's all...

Majestic