From 866b7553d9bc882348189c06355950391cc7c531 Mon Sep 17 00:00:00 2001 From: ydreniv Date: Thu, 12 Dec 2024 16:03:37 +0000 Subject: [PATCH] feat(blog): Add ddrescue article --- content/blog/2024-12-11-ddrescue.md | 74 +++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 content/blog/2024-12-11-ddrescue.md diff --git a/content/blog/2024-12-11-ddrescue.md b/content/blog/2024-12-11-ddrescue.md new file mode 100644 index 0000000..cde1493 --- /dev/null +++ b/content/blog/2024-12-11-ddrescue.md @@ -0,0 +1,74 @@ ++++ +title = "Introduction to ddrescue" +date = "2024-12-11" +updated = "2024-12-11" +[extra] +authors = ["Ydreniv"] ++++ + +Let’s suppose one of your friends come to you with a computer issue. +They’ve got a failing hard drive, and want to recover the data stored on their +device. +They are quite worried, as they have important files on it, and it’s their +only copy. +Of course, this would never happen to you, because you keep multiple encrypted +backups of all your data, in multiple place. +Only a worldwide apocalypse would get you a dataloss. +So this definitely could *only* happen to a friend, or a family member, but +not you. +It would be preposterous to think otherwise. + +So anyway, you want to copy the hard-drive. +You quickly plug it in your computer, mount it and open the file explorer. +But the mount takes a long time, accessing the files is very slow, and copying +them does not always work. +Plus, the [SMART](https://wiki.archlinux.org/title/S.M.A.R.T.) statistics show +that this drive has *issues*. +How do you extract the important data then ? +By the look of it, the vast majority of the drive sectors are fine, so what +you’re looking for still exists. +It’s merely hard to access. +It’s only a hardware problem. + +If you manage to image the drive, you can then either use it as a mounted +file, or burn it to another drive. +You could use good old `dd`. +Maybe this would work. +But here, with your friend’s disk on its deathbed, you’d like a tool adapted +for this situation. +Here comes… +**[ddrescue](https://www.gnu.org/software/ddrescue/)**. + +`ddrescue` operates on unmounted devices, and will copy a device block by +block. +Even better, it has error handling integrated. +When it cannot read a block, it will either retry or pass it, depending on the +options you’ve selected. +And, crucially, it can store its status in a file, meaning that if you stop +the process, you’ll be able to resume it later. +This way, you can quickly recover all easily available blocks, while still +retaining the ability to do several passes on the failing ones. + +I’m still a novice in `ddrescue`, so read the [Archlinux wiki +page](https://wiki.archlinux.org/title/Disk_cloning#Using_ddrescue) to get +specific instructions. +The Archlinux wiki is overall pretty good, and is one of my main source of +help on Linux, even with other distributions. +In my experiment, it has been able to recover all the disk’s sectors, except +for 47 of them. +I let it run for at least 50 hours I guess (I haven’t counted) over multiple +sessions. +I could probably try to make more passes, to eventually recover the full disk, +but I’m not sure it’s worth it (and even possible). + +It’s reassuring to know that I’ve now safeguarded most of the data. +Now that I have a mostly complete image, I’ve started trying to read them. +Unfortunately, the missing blocks do prevent me from simply mounting the +resulting image. +So I’ve still gotta do some work to actually get what I wanted (copying the +files to another drive), but at least I know that the current image is safe, +and that there shouldn’t be further data loss. + +So if you’re confronted with data recovery, I recommend giving `ddrescue` a +look. It’s quite a useful tool ! +