Continuing from the last Post, I want look at dd_rescue…
Simply, it recovers data blocks as small as 512k in fwd or rev directions to maximise the potential for reading bad sectors. If it can't, it continues on without quitting to the next sector, writing zeros in place of the corruption, which may mean possible recovery of a file once the file system is checked, then mounted again after recovery copying.
The input is an unmounted block device and the output is an image file usually, which can be mounted via loopback after processing…
# dd_rescue /dev/sdf1 /sahara/mstest.img
dd_rescue: (info): ipos: 243776.0k, opos: 243776.0k, xferd: 243776.0k
errs: 0, errxfer: 0.0k, succxfer: 243776.0k
+curr.rate: 3493kB/s, avg.rate: 3657kB/s, avg.load: 3.0%
dd_rescue: (info): /dev/sdf1 (243810.0k): EOF
Summary for /dev/sdf1 -> /sahara/mstest.img:
dd_rescue: (info): ipos: 243810.0k, opos: 243810.0k, xferd: 243810.0k
errs: 0, errxfer: 0.0k, succxfer: 243810.0k
+curr.rate: 358kB/s, avg.rate: 3652kB/s, avg.load: 3.0%
# ls -ls /sahara/mstest.img
243812 -rwxr-xr-x 1 root root 249661440 2012-05-14 01:06 /sahara/mstest.img
It looks like it has copied the full 243MB of card partition so far, so now to check and mount the image…
# fsck.vfat /sahara/mstest.img
dosfsck 3.0.1, 23 Nov 2008, FAT32, LFN
/sahara/mstest.img: 2 files, 10/60888 clusters
To mount the image…
# mount -o loop /sahara/mstest.img /mnt/
# ls /mnt/
The files are there – obviously this did not have to prove anything other than to copy and convert good data, as nothing was corrupt – but shows the procedure of imaging original data.
Now you can try on corrupt media by making the dd_rescue image of it to maximise recovery of what is there and not overwriting the original further.
You do any further data recovery operations on the image, leaving the original corrupt media as is, to be able to make further images from if there is a problem or mistake in recovery.
See also testdisk and photorec