dd_rescue

---

Basic Features of dd_rescue

While dd is a general purpose data-copying tool, dd_rescue is intended specifically for copying filesystems off of potentially failing media. The default settings of dd_rescue are similar in intent to dd with the options "conv=noerror,sync", but more efficient. In addition, dd_rescue provides the following additional functionality:

• dd_rescue switches between two block sizes when copying data, to provide both speed for intact regions of the disk and thorough data recovery for damaged areas.
• Allows copying blocks backward, so that if a block has errors in the middle, data both before and after the string of errors will be copied.

Hard drive recovery scenario

A simple recovery scenario occurs when a hard drive fails. For instance, assume /dev/hda1 is failing. Often the result will be a mostly-working system, but one which generates error messages periodically as bad sectors of the failing drive are touched. At this point the priority is to extract what data can be recovered from the partition to a working hard drive, where the filesystem may be repaired. (Attempts to repair the filesystem in-place will almost certainly fail, and further unnecessary disk activity carries the risk of further damage to the drive.)

The typical recovery plan with the dd command is something like this:

• On a new hard drive, a target partition (assume it is /dev/hdb1) is created with the same size as the failing partition.
• dd is run to copy the source partition to the target partition, ignoring errors:

# dd if=/dev/hda1 of=/dev/hdb1 bs=4k conv=noerror,sync

This will do the job, but one must consider the block size. As dd copies data with the conv=noerror,sync option, any errors it encounters will result in the remainder of the block being replaced with zero-bytes. Larger block sizes will copy more quickly, but each time an error is encountered the remainder of the block is ignored. Smaller block sizes minimize this data loss, but copying with a smaller block size is more time consuming, first because the process of reading and writing small blocks to copy a file is less efficient than for larger blocks, and second because if a string of errors is longer than the small block size, the process will waste time attempting to read bad sectors which otherwise would have been skipped over.

dd_rescue can perform the same operation as dd in this case, but provide a more thorough recovery than dd with "bs=4k" and a faster recovery than dd with a smaller block size. The command

# dd_rescue /dev/hda1 /dev/hdb1

will copy 64k chunks of the file unless an error is encountered - when an error is encountered, it will switch to copying 512 byte chunks, until a certain number of blocks are copied error-free, at which point it'll switch back to 64k chunks.

dd_rescue and dd_rhelp

dd_rescue provides a good selection of tools to recover data. However, one issue with its default copying process is that it can waste a lot of time attempting to recover data from damaged sectors, delaying the recovery of other non-damaged sectors. Attempting a more thorough recovery requires significantly greater amounts of time - but the benefits of attempting recovery on a damaged region are limited, and often not worth the added effort. There is a point at which attempting more thorough recovery is not worth the required time.

dd_rhelp is a wrapper script for dd_rescue which provides the following features:

• Attempts to retrieve the majority of the non-damaged data as quickly as possible (runs dd_rescue multiple times, aborting after a small number of errors and restarting at another point on the disk)
• Performs a second pass to attempt further recovery of data from the damaged sectors (using remembered information on which blocks weren't copied in the first pass, revisits using a smaller block size, reverse copy option, etc.)
• Provides a status display showing the progress of the operation

This makes dd_rhelp a useful companion to dd_rescue, particularly in cases where there are large, contiguous regions of bad blocks in the source drive, or in cases where you are content with recovering the majority of the data rather than all that is recoverable.

---