Disk Cloning (for Data Recovery) with GNU ddrescue

Disclaimer: This article is intended for those of you technically inclined enough to even attempt data recovery. This involves (minimally) being able to burn a CD, use command-line utilities, and some hardware knowledge.

Things to Know

If your hard drive is dying (i.e. making weird clicky noises, giving read errors, etc) MAKE A CLONE COPY OF IT ASAP. The more you use your dying drive, the greater the likelihood of more errors developing. Copy your data onto a different (not dying) drive and then stop using the bad drive. Always perform data recovery techniques on a copy of the original drive. If one of the data recovery techniques fails, it may further scramble your data. Work from a copy. I can't emphasize that enough.

Linux has a very handy tool called ddrescue which can make a clone copy of a disk. It also offers the option to keep retrying to read the bad areas after the first pass, in hopes that maybe it'll work on the 2nd, 3rd, 4th try, etc.

Things You Will Need

• Your bad hard drive.
• A working hard drive which has at least as much storage as your bad hard drive.
• A way to burn yourself a copy of  System Rescue CD (or any other Linux Live CD which includes ddrescue)
• A computer with both (bad and good) drives connected to it.

The Procedure

1. Boot the computer with the System Rescue CD.
2. At the root# prompt type fdisk -l to list all the attached drives.
3. Assuming we're dealing with 2 modern SATA hard disks, likely one will be listed as /dev/sda and one will be listed as /dev/sdb (this may vary depending on your configuration)
   
   For the purpose of this article, we shall say /dev/sda is the bad drive and /dev/sdb is the working drive.
4. Clone sda to sdb with ddrescue:
   
   root# ddrescue -r=1 -n -S -v /dev/sda /dev/sdb recovery.log
5. Here's a breakdown of what the command actually does:
1. -r=1 = retry the damaged areas infinite times
2. -n = Skip the splitting pass. Avoids spending a lot of time trying to rescue the most difficult parts of the file.
3. -S = Sparse mode. May save a lot of disk space in some cases.
4. -v = Verbose mode. Shows all the details about what's happening.
5. /dev/sda = the source drive
6. /dev/sdb = the destination drive
7. recovery.log = The name of the log file. (can be whatever name you want.) In case you need to stop and restart the process, the log file will keep the spot of where the process left off.
6. This process can be very slow. Depending on the size of your drive and how badly it's performing, it can take days. However, if your data is really that important, it's worth it. Patience is key.
7. Once the drive finishes it's initial pass of copying the good parts of the drive, it will continue to retry the areas which had errors. Typically by about 4+ passes of the bad areas, it's pretty much certain you're not going to get any more information from those areas of the drive. Cancel the ddrescue process via CTRL-C. Store the damaged drive in a static bag. Don't do anything more with it in case you need to clone it again.
8. Hook up the drive with the copy of the bad disk as a secondary drive on a working computer. See if you can access the data. There's a number of applications available which will attempt to repair the drive if it's still unreadable. (Perhaps the File Allocation Table needs to be rebuilt.)

Here is a pretty good list of data recovery software you may want to try on your cloned disk.

Just remember don't run data recovery software on the original drive. It may cause further damage to the disk and render your data completely unrecoverable. Always work from a copy.