Save Your Data from the Click of Death

by Kyle Rankin

Related link: http://www.garloff.de/kurt/linux/ddrescue/



One thing I like about Linux is that there are always tools out there to discover that save you a lot of time or in this case data. I always love to walk a new user through transferring files from one drive to another and tell them "now run watch df to check the output."

"Watch? Oh WOW why didn't I know about this before?"

Well, I had another one of those moments the other day when I ran across dd_rescue. This utility addresses the issue of using dd to image a drive that has bad blocks or otherwise has errors. When dd hits an error, it fails, so you are left with using skip and seek arguments to try to route around the bad blocks. Dd_rescue addresses this by simply skipping bad blocks it finds (or trying X number of times before skipping if you wish), so you can image even failing drives full of bad blocks.

Of course, dd_rescue has its problems as well. While it does skip bad blocks, it takes it some time to do so, and since bad blocks are often grouped together, it can take a very long time to dig through a group of bad blocks. If this group is at the front of your data, you are wasting the valuable last breaths of your hard drive looking at bad blocks, instead of recovering good ones.

The dd_rhelp script addresses this by acting as a front-end for dd_rescue. When dd_rescue finds a bad block, dd_rhelp has it jump ahead a bit, and then read blocks in reverse until it finds the tail end of the bad block group. It then continues forward and grabs all of the good blocks first. Then, after it finishes grabbing your good data, it goes back to the bad data and attempts to recover what it can from there.

dd_rhelp has an added advantage in that it can also resume at any point in the recovery by keeping track of where it is in dd_rescue's logs. So if you have to Ctrl-C from the process, you can just re-run it and dd_rhelp will pick up where it left off. Also, it has a nice little ASCII progress meter, which is useful for keeping track of where you are.

Of course, it makes sense to not run this rescue while you are booted into the bad drive, so either move the drive to another system, or use some sort of rescue disk like Knoppix.

So, to use this, download dd_rescue version 1.03 or later (1.03 is also packaged in Debian unstable at the moment, but testing seems to have 1.02) from its site, and then get the latest version of dd_rhelp. While older versions of dd_rescue will work by themselves, dd_rhelp requires 1.03. Building dd_rhelp is a simple matter of untarring and running ./configure && make, and it even compiled just fine under Knoppix.

Once the tools are ready, you can recover a drive with

# dd_rhelp /dev/hda1 /mnt/hdb1/hda1_rescue.img


Then run fsck on the image you have created, mount it loopback (mount -o loop /mnt/hdb1/hda1_rescue.img /mnt/hda1 in my case) and then browse through it and recover the files you need.

Now you can see if you still have a warranty on the drive and return it, demolish it with a sledgehammer, or take it apart and use it as a desk accessory.

What are some of your "click of death" horror stories? IBM Deathstar or otherwise!


4 Comments

lbruno
2004-07-17 03:19:32
An alternative to dd_rescue
dd conv=noerror
Sums
2004-07-21 02:41:20
An alternative to dd_rescue
Sorry, not really. dd with conv=noerror writes nothing in the image in case of a bad block. Your image gets smaller and may be not mountable. dd_rescue writes Zeros in the image. The size of your image becomes the size of the partition.


HAND


Oliver

Antonio_Diaz
2004-09-03 18:37:16
A real alternative to dd_rescue + dd_rhelp
Is ddrescue http://freshmeat.net/projects/dd_rescue/ (don't confuse it with Garloff's dd_rescue).


ddrescue will:
1) Read the non-damaged part of the disk, skipping the damaged areas.
or
1) Read a list of bad blocks (damaged areas) from a file.


2) Try to read the damaged areas, splitting them into smaller pieces and reading the non-damaged pieces, until the hardware block size is reached.


3) Try to read the damaged hardware blocks until the specified number of retries is reached, or until interrupted by the user.


4) Optionally write a list of bad blocks to a file.

Antonio_Diaz
2005-02-05 11:01:57
A real alternative to dd_rescue + dd_rhelp
Ddrescue is now part of the GNU project. Its new homepage is http://www.gnu.org/software/ddrescue/ddrescue.html.