INGLES 1 IntroductionGNU ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors. The basic operation of ddrescue is fully automatic. That is, you don't have to wait for an error, stop the program, read the log, run it backwards, etc. If you use the logfile feature of ddrescue, the data is rescued very efficiently, (only the needed blocks are read). Also you can interrupt the rescue at any time and resume it later at the same point. Ddrescue does not write zeros to the output when it finds bad sectors in the input, and does not truncate the output file if not asked to. So, every time you run it on the same output file, it tries to fill in the gaps without wiping out the data already rescued. Automatic merging of backups: If you have two or more damaged copies of a file, cdrom, etc, and run ddrescue on all of them, one at a time, with the same output file, you will probably obtain a complete and error-free file. This is so because the probability of having damaged areas at the same places on different input files is very low. Using the logfile, only the needed blocks are read from the second and successive copies. Ddrescue recommends lzip for compression of backups because of its reliability and data recovery capabilities, including error-checked merging of backup copies. The combination ddrescue + lziprecover is the best option for recovering data from multiple damaged copies. See lziprecover-example, for an example. Recordable CD and DVD media keep their data only for a finite time (typically for many years). After that time, data loss develops slowly with read errors growing from the outer media region towards the inside. Just make two (or more) copies of every important CD/DVD you burn so that you can later recover them with ddrescue. Because ddrescue needs to read and write at random places, it only works on seekable (random access) input and output files. If your system supports it, ddrescue can use direct disc access to read the input file, bypassing the kernel cache.

Ddrescue also features a "fill mode" able to selectively overwrite parts of the output file, which has a number of interesting uses like wiping data, marking bad areas or even, in some cases, "repair" damaged sectors. Next: Algorithm, Previous: Introduction, Up: Top

2 Basic ConceptsBlock Any amount of data. A block is described by its starting position and its size. Cluster Group of consecutive sectors read or written in one go. Device Piece of hardware containing data. Hard disc drives, cdrom drives, USB pendrives, are devices. /dev/hda, /dev/sdb, are device names. File Files are named units of data which are stored by the operating system for you to retrieve later by name. Devices are accessed by means of their associated file names. Partition Every part in which a device is divided. A partition normally contains a file system. /dev/hda1, /dev/sdb3, are partition names. Recoverable formats As ddrescue uses standard library functions to read data from the device being rescued, only mountable device formats can be rescued with ddrescue. DVDs can be mounted and they can be rescued, "compact disc digital audio" CDs can't, "video CDs"[1] maybe. [1] http://en.wikipedia.org/wiki/Video_CD Rescue domain Block or set of blocks to be acted upon (rescued, listed, etc). You can define it with the options `--input-position', `--max-size' and `--domain-logfile'. The rescue domain defaults to the whole input file or logfile. Sector Hardware block. Smallest accessible amount of data on a device. Next: Invoking Ddrescue, Previous: Basic Concepts, Up: Top

3 AlgorithmGNU ddrescue manages efficiently the status of the rescue in progress and tries to rescue the good parts first, scheduling reads inside bad (or slow) areas

for later. This maximizes the amount of data that can be finally recovered from a failing drive. The standard dd utility can be used to save data from a failing drive, but it reads the data sequentially, which may wear out the drive without rescuing anything if the errors are at the beginning of the drive. Other programs switch to small size reads when they find errors, but they still read the data sequentially. This is a bad idea because it means spending more time at error areas, damaging the surface, the heads and the drive mechanics, instead of getting out of them as fast as possible. This behavior reduces the chances of rescuing the remaining good data. The algorithm of ddrescue is as follows (the user may interrupt the process at any point, but be aware that a bad drive can block ddrescue for a long time until the kernel gives up): 1) Optionally read a logfile describing the status of a multi-part or previously interrupted rescue. If no logfile is specified or is empty or does not exist, mark all the rescue domain as non-tried. 2) Read the non-tried parts of the input file, marking the failed blocks as nontrimmed and skipping beyond them, until all the rescue domain is tried. Only non-tried areas are read in large blocks. Trimming, splitting and retrying are done sector by sector. Each sector is tried at most two times; the first in this step as part of a large block read, the second in one of the steps below as a single sector read. 3) Read backwards one sector at a time the non-trimmed blocks, until a bad sector is found. For each non-trimmed block, mark the bad sector found as bad-sector and mark the rest of that block as non-split. 4) Read forwards one sector at a time the non-split blocks, marking the bad sectors found as bad-sector. After a number of consecutive bad sectors is found in a block large enough, the block is split by half and the reading continues on the second half. This recursively splits the largest failed blocks without producing a logfile too large. 5) Optionally try to read again the bad sectors until the specified number of retries is reached. 6) Optionally write a logfile for later use. Note that as ddrescue splits the failed blocks, making them smaller, the total error size may diminish while the number of errors increases.

The logfile is periodically saved to disc, as well as when ddrescue finishes or is interrupted. So in case of a crash you can resume the rescue with little recopying. Also, the same logfile can be used for multiple commands that copy different areas of the input file, and for multiple recovery attempts over different subsets. See this example: Rescue the most important part of the disc first.ddrescue -i0 -s50MiB /dev/hdc hdimage logfile ddrescue -i0 -s1MiB -d -r3 /dev/hdc hdimage logfile

Then rescue some key disc areas.ddrescue -i30GiB -s10GiB /dev/hdc hdimage logfile ddrescue -i230GiB -s5GiB /dev/hdc hdimage logfile

Now rescue the rest (does not recopy what is already done).ddrescue /dev/hdc hdimage logfile ddrescue -d -r3 /dev/hdc hdimage logfile

Next: Logfile Structure, Previous: Algorithm, Up: Top

4 Invoking DdrescueThe format for running ddrescue is:ddrescue [options] infile outfile [logfile]

ddrescue supports the following options: `-h' `--help' Print an informative help message describing the options and exit. `-V' `--version' Print the version number of ddrescue on the standard output and exit. `-a bytes' `--min-read-rate=bytes' Minimum read rate of good non-tried areas, in bytes per second. If the read rate falls below this value, ddrescue will skip ahead a variable amount depending on rate and error history. The skipped blocks are tried in additional passes (before trimming) where the minimum read rate is divided by ten before each pass, until there are no more non-tried

blocks left. If bytes is 0 (auto), the minimum read rate is recalculated for each block read as (average_rate / 10). Note that specifying a minimum read rate above the posibilities of the input device will result in a very low average rate because all reads will be considered slow reads and continuous skipping will occur. This will also make the logfile grow disproportionately. `-A' `--try-again' Mark all non-split and non-trimmed blocks inside the rescue domain as non-tried before beginning the rescue. Try this if the drive stops responding and ddrescue immediately starts splitting failed blocks when restarted. If `--retrim' is also specified, mark all failed blocks inside the rescue domain as non-tried. `-b bytes' `--block-size=bytes' Sector (hardware block) size of input device in bytes (usually 512 for hard discs and 3.5" floppies, 1024 for 5.25" floppies, and 2048 for cdroms). Defaults to 512. `-B' `--binary-prefixes' Show units with binary prefixes (powers of 1024). SI prefixes (powers of 1000) are used by default. (See table below). `-c sectors' `--cluster-size=sectors' Number of sectors to copy at a time. Defaults to 64 KiB / sector_size. Try smaller values for slow drives. The number of sectors per track (18 or 9) is a good value for floppies. `-C' `--complete-only' Limit rescue domain to the blocks listed in the logfile. Do not read new data beyond logfile limits. This is useful when reading from devices of undefined size, like raw devices, or when the drive returns an incorrect size. It can only be used after a first rescue attempt, possibly limited with the `--max-size' option, has produced a complete logfile. `-d' `--direct' Use direct disc access to read from infile, bypassing the kernel cache. (Open the file with the O_DIRECT flag). Use it only on devices or partitions, not on regular files. Sector size must be correctly set for this to work. Not all systems support this.

If your system does not support direct disc access, ddrescue will warn you. If the sector size is not correctly set, all reads will result in errors, and no data will be rescued. `-D' `--synchronous' Use synchronous writes for outfile. (Issue a fsync call after every write). May be useful when forcing the drive to remap its bad sectors. `-e [+]n' `--max-errors=[+]n' Maximum number of error areas allowed before giving up. Defaults to infinity. If n is preceded by `+' the number refers to new error areas found in this run, not counting those already annotated in the logfile. `-E bytes' `--max-error-rate=bytes' Maximum rate of errors allowed before giving up, in bytes per second. Defaults to infinity. The rate being measured is that of actually failed reads, so the rescue may finish because of this rate being exceeded even if the total error size (errsize) does not change because the areas being tried are already marked as errors. `-f' `--force' Force overwrite of outfile. Needed when outfile is not a regular file, but a device or partition. `-F types' `--fill=types' Fill the blocks in outfile specified as any of types in logfile, with data read from infile. types contains one or more of the status characters defined in the chapter Logfile Structure (see Logfile Structure). See the chapter Fill Mode (see Fill Mode) for a complete description of the fill mode. `-g' `--generate-logfile' Generate an approximate logfile from the infile and outfile of the original rescue run. Note that you must keep the original offset between `--input-position' and `--output-position' of the original rescue run. See the chapter Generate Mode (see Generate Mode) for a complete description of the generate mode. `-i bytes' `--input-position=bytes' Starting position in infile, in bytes. Defaults to 0. In fill mode it refers to a position in the infile of the original rescue run. See the chapter Fill Mode (see Fill Mode) for details.

`-I' `--verify-input-size' Compare the size of infile with the size calculated from the list of blocks contained in the logfile, and exit with status 1 if they differ. This is not enabled by default because the size of some devices can't be known in advance and because the size derived from the logfile may be incomplete, for example after doing a partial rescue. `-K bytes' `--skip-size=bytes' Set the initial size to skip on the first read error or slow read. The value given will be rounded to the next multiple of sector size. For subsequent read errors or slow reads, ddrescue will modify the skip size depending on error rate and error history. Valid values range from 64 KiB to 1 GiB. Defaults to 64 KiB. `-m file' `--domain-logfile=file' Restrict the rescue domain to the blocks marked as finished in the logfile file. This is useful if the destination drive fails during the rescue. `-M' `--retrim' Mark all failed blocks inside the rescue domain as non-trimmed before beginning the rescue. The effect is similar to `--max-retries=1', but the bad sectors are tried in a different order, making perhaps possible to rescue some of them. `-n' `--no-split' Skip the splitting pass. Avoids spending a lot of time trying to rescue the most difficult parts of the file. `-o bytes' `--output-position=bytes' Starting position in outfile, in bytes. Defaults to `--inputposition'. The bytes below bytes aren't touched if they exist and truncation is not requested. Else they are set to 0. `-p' `--preallocate' Preallocate space on disc for outfile. Only space for regular files can be preallocated. If preallocation succeeds, rescue will not fail due to lack of free space on disc. If ddrescue can't determine the size to preallocate, you may need to specify it with some combination of the `--inputposition', `--output-position', `--max-size', and `-domain-logfile' options. `-q'

`--quiet' Quiet operation. Suppress all messages. `-r n' `--max-retries=n' Exit after given number of retry passes. Defaults to 0. -1 means infinity. Every bad sector is tried only one time per pass. To retry bad sectors detected on a previous run, you must specify a non-zero number of retries. `-R' `--reverse' Reverse direction of all copy operations. This makes copying, splitting and retrying to be run backwards, and trimming to be run forwards. `-s bytes' `--max-size=bytes' Maximum size of the input data to be copied, in bytes. If ddrescue can't determine the size of the input device, you may need to specify it with this option. Note that this option specifies the size of the input data to be copied, not the size of the resulting outfile. So, for example, the following command creates an outfile 300 bytes long, but only writes data on the last 200 bytes:ddrescue -i 100 -s 200 infile outfile logfile

`-S' `--sparse' Use sparse writes for outfile. (The blocks of zeros are not actually allocated on disc). May save a lot of disc space in some cases. Not all systems support this. Only regular files can be sparse. `-t' `--truncate' Truncate outfile to zero size before writing to it. Only works for regular files, not for drives or partitions. `-T interval' `--timeout=interval' Maximum time since last successful read allowed before giving up. Defaults to infinity. interval is a rational number (like 1.5 or 1/2) optionally followed by one of `s', `m', `h' or `d', meaning seconds, minutes, hours and days respectively. If no unit is specified, it defaults to seconds. `-v' `--verbose' Verbose mode. Further -v's (up to 4) increase the verbosity level. `-x bytes' `--extend-outfile=bytes'

Extend the size of outfile to make it at least bytes long. If the size of outfile is already equal or longer than bytes then this option does nothing. Use this option to guarantee a minimum size for outfile. Only regular files can be extended. Numbers given as arguments to options (positions, sizes, retries, etc) may be followed by a multiplier and an optional `B' for "byte". Table of SI and binary prefixes (unit multipliers):Prefix Value k M G T P E Z Y | Prefix Value |b hardware blocks kilobyte (10^3 = 1000) | Ki kibibyte (2^10 = 1024) megabyte (10^6) | Mi mebibyte (2^20) gigabyte (10^9) | Gi gibibyte (2^30) terabyte (10^12) | Ti tebibyte (2^40) petabyte (10^15) | Pi pebibyte (2^50) exabyte (10^18) | Ei exbibyte (2^60) zettabyte (10^21) | Zi zebibyte (2^70) yottabyte (10^24) | Yi yobibyte (2^80)

Return values: 0 for a normal exit, 1 for environmental problems (file not found, invalid flags, I/O errors, etc), 2 to indicate a corrupt or invalid input file, 3 for an internal consistency error (eg, bug) which caused ddrescue to panic. Next: Examples, Previous: Invoking Ddrescue, Up: Top

5 Logfile StructureThe logfile is a text file easy to read and edit. It is formed by three parts, the heading comments, the status line, and the list of data blocks. Any line beginning with `#' is a comment line. The blocks in the list of data blocks must be contiguous and non-overlapping. NOTE: Logfiles generated by a version of ddrescue prior to 1.6 lack the status line. If you want to use an old logfile with ddrescue 1.6 or later, you will have to insert a line like `0 +' at the beginning of the logfile. The heading comments contain the version of ddrescue and the command line used to create the logfile. They are intended as information for the user.

The first non-comment line is the status line. It contains a non-negative integer and a status character. The integer is the position being tried in the input file. The status character is one of these:Character Meaning '?' copying non-tried blocks '*' trimming non-trimmed blocks '/' splitting non-split blocks '-' retrying bad sectors 'F' filling specified blocks 'G' generating approximate logfile '+' finished

Every line in the list of data blocks describes a block of data. It contains 2 non-negative integers and a status character. The first integer is the starting position of the block in the input file, the second integer is the size (in bytes) of the block. The status character is one of these:Character Meaning '?' non-tried block '*' failed block non-trimmed '/' failed block non-split '-' failed block bad-sector(s) '+' finished block

And here is an example logfile: # Rescue Logfile. Created by GNU ddrescue version 1.16 # Command line: ddrescue /dev/fd0 fdimage logfile # current_pos current_status 0x00120000 ? # pos size status0x00000000 0x00117000 + 0x00117000 0x00000200 0x00117200 0x00001000 / 0x00118200 0x00007E00 * 0x00120000 0x00048000 ?

If you edit the file, you may use decimal, hexadecimal or octal values, using the same syntax that integer constants in C++. Next: Direct Disc Access, Previous: Logfile Structure, Up: Top

6 A small tutorial with examplesDdrescue is like any other power tool. You need to understand what it does, and you need to understand some things about the machines it does those things to, in order to use it safely. A failing drive tends to develop more and more errors as time passes. Because of this, you should rescue the data from a drive as soon as you notice the first error. Be diligent because every time a physically damaged drive powers up and is able to output some data, it may be the very last time that it ever will. You should make a copy of the failing drive with ddrescue, and then try to repair the copy. If your data is really important, use the first copy as a master for a second copy, and try to repair the second copy. If something goes wrong, you have the master intact to try again. IMPORTANT! Always use a logfile unless you know you won't need it. Without a logfile, ddrescue can't resume a rescue, only reinitiate it. IMPORTANT! Never try to rescue a r/w mounted partition. The resulting copy may be useless. IMPORTANT! If you use a device or a partition as destination, any data stored there will be overwritten. IMPORTANT! If you interrupt the rescue and then reboot, any partially copied partitions should be hidden before allowing them to be touched by any operating system that tries to mount and "fix" the partitions it sees. IMPORTANT! Never try to repair a file system on a drive with I/O errors; you will probably lose even more data. If you are trying to rescue a whole partition, first repair the copy with e2fsck or some other tool appropiate for the type of partition you are trying to rescue, then mount the repaired copy somewhere and try to recover the files in it. If the drive is so damaged that the file system in the rescued partition can't be repaired or mounted, you will have to browse the rescued data with an hex editor and extract the desired parts by hand or use a file recovery tool like photorec. If the partition table is damaged, you may try to rescue the whole disc, then try to repair the partition table and the partitions on the copy.

If the damaged drive is not listed in /dev, then you cannot rescue it. At least not with ddrescue. Example 1: Rescue a whole disc with two ext2 partitions in /dev/hda to /dev/hdb. Note: you do not need to partition /dev/hdb beforehand, but if the partition table on /dev/hda is damaged, you'll need to recreate it somehow on /dev/hdb.ddrescue -f -n /dev/hda /dev/hdb logfile ddrescue -d -f -r3 /dev/hda /dev/hdb logfile fdisk /dev/hdb e2fsck -v -f /dev/hdb1 e2fsck -v -f /dev/hdb2

Example 2: Rescue an ext2 partition in /dev/hda2 to /dev/hdb2. Note: you need to create the hdb2 partition with fdisk first. hdb2 should be of appropiate type and size.ddrescue -f -n /dev/hda2 /dev/hdb2 logfile ddrescue -d -f -r3 /dev/hda2 /dev/hdb2 logfile e2fsck -v -f /dev/hdb2 mount -t ext2 -o ro /dev/hdb2 /mnt (read rescued files from /mnt)

Example 3: Rescue a CD-ROM in /dev/cdrom.ddrescue -n -b2048 /dev/cdrom cdimage logfile ddrescue -d -b2048 /dev/cdrom cdimage logfile (write cdimage to a blank CD-ROM)

Example 4: Rescue a CD-ROM in /dev/cdrom from two copies.ddrescue -n -b2048 /dev/cdrom cdimage logfile ddrescue -d -b2048 /dev/cdrom cdimage logfile (insert second copy in the CD drive) ddrescue -d -r1 -b2048 /dev/cdrom cdimage logfile (write cdimage to a blank CD-ROM)

Example 5: Rescue a lzip compressed backup from two copies on CD-ROM with error-checked merging of copies (See the lziprecover manual for details about lziprecover).ddrescue -b2048 /dev/cdrom cdimage1 logfile1 mount -t iso9660 -o loop,ro cdimage1 /mnt/cdimage cp /mnt/cdimage/backup.tar.lz rescued1.tar.lz umount /mnt/cdimage (insert second copy in the CD drive) ddrescue -b2048 /dev/cdrom cdimage2 logfile2 mount -t iso9660 -o loop,ro cdimage2 /mnt/cdimage cp /mnt/cdimage/backup.tar.lz rescued2.tar.lz umount /mnt/cdimage lziprecover -m -v -o rescued.tar.lz rescued1.tar.lz rescued2.tar.lz

Example 6: While rescuing the whole drive /dev/hda to /dev/hdb, /dev/hdb fails and you have to rescue data to a third drive, /dev/hdc.ddrescue -f -n /dev/hda /dev/hdb logfile1 here ddrescue -f -m logfile1 /dev/hdb /dev/hdc logfile2 badblocks1 ddrescuelog -l- -b4096 logfile2 > badblocks2 e2fsck -v -f -L badblocks1 /dev/hdb1 e2fsck -v -f -L badblocks2 /dev/hdb2