Recover data from a failing drive (possibly with bad sectors)

ddrescue is a fabulous tool/utility available in Linux. It can help to recover data from any failing hard disk. If your drive has failed, i.e. your drive cannot be detected by the BIOS, ddrescue will be of no help and the drive would need to be sent to a data recovery expert (who will charge you hundreds of dollars to recover what ever data possible).

ddrescue is available on SystemRescueCD. SystemRescueCD is exactly what it says it is - a system rescue CD, which uses Linux, and boots up either from a CD or a USB stick. It is possibly the one most important piece of software which I would advice any PC user to have. Or course, you would need to be familiar with the Linux OS and you would need to have some basic knowledge of the Linux interface. This article will not dive into the details of the SystemRescueCD. So, let's get back to ddrescue.

The ddrescue manual can be found at http://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html.

NOTE: In the steps below, "/dev/sdc" is the drive which has the failing drive. "/dev/sdb" is the good/new drive, which is the destination to copy the data to. "/mnt/usbstick/ddrescuelog.log" is the logfile which will be created (if you do not have this log file, re-trying failures or resuming recovery if the system needs to be shutdown will not be possible). Replace the above with the appropriate paths as needed for your own purposes.

Steps to recover as much data possible from a drive which has bad sectors:

1. Copy as much data as possible, without retrying or splitting sectors:

ddrescue --no-split /dev/sdc /dev/sdb /mnt/usbstick/ddrescuelog.log

2. Now let it retry previously detected errors 3 times:

ddrescue -r 3 /dev/sdc /dev/sdb /mnt/usbstick/ddrescuelog.log

3. Run successive passes like this to use the log file to only read the gaps with errors:

ddrescue -r 3 --complete-only /dev/sdc /dev/sdb /mnt/usbstick/ddrescuelog.log

4. Now let it retry previous errors 3 times, using uncached reads:

ddrescue --direct -r 3 /dev/sdc /dev/sdb /mnt/usbstick/ddrescuelog.log

5. If that fails, try again but retrimmed, so it tries to reread full sectors:

ddrescue --direct --retrim -r 3 /dev/sdc /dev/sdb /mnt/usbstick/ddrescuelog.log

These steps should be somewhat sufficient to retrieve as much data as possible from a failing drive. There is not guarantee that all the data will be able to be retrieved. Only data from sectors which do not have any physical damage will be able to be retrieved.

It helped me.

For other links on this matter, you can also refer to the following links:

a. https://help.ubuntu.com/community/DataRecovery

b. http://www.forensicswiki.org/wiki/Ddrescue

What I have not tried, which these websites suggest are the following:

- ntfsfix /dev/sdc

- fsck -t ntfs

- fsck.ntfs