Cool Cmd #6 – dd_rescue

Continuing from the last Post, I want look at dd_rescue…

Simply, it recovers data blocks as small as 512k in fwd or rev directions to maximise the potential for reading bad sectors. If it can't, it continues on without quitting to the next sector, writing zeros in place of the corruption, which may mean possible recovery of a file once the file system is checked, then mounted again after recovery copying.

The input is an unmounted block device and the output is an image file usually, which can be mounted via loopback after processing… 

# dd_rescue /dev/sdf1 /sahara/mstest.img 

dd_rescue: (info): ipos: 243776.0k, opos: 243776.0k, xferd: 243776.0k 

errs: 0, errxfer: 0.0k, succxfer: 243776.0k 

+curr.rate: 3493kB/s, avg.rate: 3657kB/s, avg.load: 3.0% 

dd_rescue: (info): /dev/sdf1 (243810.0k): EOF 

Summary for /dev/sdf1 -> /sahara/mstest.img: 

dd_rescue: (info): ipos: 243810.0k, opos: 243810.0k, xferd: 243810.0k 

errs: 0, errxfer: 0.0k, succxfer: 243810.0k 

+curr.rate: 358kB/s, avg.rate: 3652kB/s, avg.load: 3.0% 

# ls -ls /sahara/mstest.img 

243812 -rwxr-xr-x 1 root root 249661440 2012-05-14 01:06 /sahara/mstest.img 

It looks like it has copied the full 243MB of card partition so far, so now to check and mount the image…

# fsck.vfat /sahara/mstest.img

dosfsck 3.0.1, 23 Nov 2008, FAT32, LFN 

/sahara/mstest.img: 2 files, 10/60888 clusters 

To mount the image…

# mount -o loop /sahara/mstest.img /mnt/ 

# ls /mnt/ 

hashes.txt ReportTemplate.doc 

The files are there – obviously this did not have to prove anything other than to copy and convert good data, as nothing was corrupt – but shows the procedure of imaging original data.

Now you can try on corrupt media by making the dd_rescue image of it to maximise recovery of what is there and not overwriting the original further.

You do any further data recovery operations on the image, leaving the original corrupt media as is, to be able to make further images from if there is a problem or mistake in recovery.

See also testdisk and photorec