GNU ddrescue

GNU ddrescue is a data recovery and disk imaging tool designed to copy data from failing or damaged storage devices. Unlike standard dd, it uses a sophisticated algorithm that skips bad sectors, logs errors, and enables resumable recoveries without corrupting the output image.

Installation

# Debian/Ubuntu
sudo apt-get install gddrescue

# Red Hat/CentOS/Fedora
sudo yum install ddrescue

# macOS (Homebrew)
brew install ddrescue

# From source
wget https://www.gnu.org/software/ddrescue/ddrescue-1.27.tar.gz
tar xzf ddrescue-1.27.tar.gz
cd ddrescue-1.27
./configure && make && sudo make install

Basic Syntax

ddrescue [OPTIONS] <infile> <outfile> [<logfile>]

Component	Description
`<infile>`	Source device or file (failing drive)
`<outfile>`	Destination file or device (disk image)
`<logfile>`	Recovery log for tracking progress and bad sectors

Core Options

Option	Description
`-n`	Do not read the output file (always write)
`-r NUM`	Number of retry attempts (default: -1, infinite)
`-R`	Reverse pass (read from end to beginning)
`-e`	Max number of errors before stopping
`-d`	Use direct I/O (bypass kernel cache)
`-D`	Use O_DIRECT flag where available
`-T`	Disable truncation of output file
`-b SIZE`	Block size (default: 512 bytes)
`-s BYTES`	Start position in source file
`-S BYTES`	Start position in output file
`-m BYTES`	Maximum input file size
`-L`	Test input device for errors
`-G`	Synchronize output with input (slower, safer)
`-I`	Ignore input file size
`-O`	Treat output as input (bi-directional recovery)
`--sparse`	Use sparse file I/O (skip zero blocks)
`--verbose`	Increase verbosity
`--quiet`	Suppress output

Essential Workflows

Basic Drive Clone with Logging

# Clone a failing /dev/sdb to disk image
sudo ddrescue -D /dev/sdb /tmp/backup.img /tmp/backup.log

# Shows progress, estimated time, and error locations
# Rerun same command to continue from where it left off
sudo ddrescue -D /dev/sdb /tmp/backup.img /tmp/backup.log

Fast Recovery with Retry Strategy

# First pass: skip bad sectors, copy readable data
sudo ddrescue -n /dev/sdb /tmp/backup.img /tmp/backup.log

# Second pass: retry bad sectors with limited attempts
sudo ddrescue -d -r 3 /dev/sdb /tmp/backup.img /tmp/backup.log

# Third pass: slow reverse read from end to beginning
sudo ddrescue -R /dev/sdb /tmp/backup.img /tmp/backup.log

Reverse Pass (Read Backwards)

# Helps recover data near end of drive first
# Useful when drive is failing progressively
sudo ddrescue -R -d /dev/sdb /tmp/backup.img /tmp/backup.log

Test Drive for Errors

# Scan drive without copying, identify bad areas
sudo ddrescue -L /dev/sdb /tmp/test.log

# Results show which sectors are bad
cat /tmp/test.log

Understanding the Log File

Log File Format

# Pos     Status
0x00000000  ?   # Unread (bad sector)
0x00400000  +   # Successfully read
0x00800000  -   # Error, retried
0x01000000  /   # Recovering

Status Symbol	Meaning
`+`	Successfully read
`-`	Error reading (can retry)
`?`	Unread (bad sector, skipped)
`/`	Currently being recovered
`*`	Uninitialized

Interpreting Bad Sector Maps

# View human-readable log
sudo ddrescue -i /tmp/backup.log

# Shows start/end positions and status of each block
# Example output:
#     pos        size      status
# 0x00000000   0x100000    +
# 0x00100000   0x50000     -
# 0x00150000   0xb0000     +

Advanced Techniques

Multi-Pass Recovery Strategy

# Pass 1: Fast initial copy, skip errors
sudo ddrescue -n -e 100 /dev/sdb /tmp/image.img /tmp/image.log

# Pass 2: Focused retry on bad sectors
sudo ddrescue -d -r 5 /dev/sdb /tmp/image.img /tmp/image.log

# Pass 3: Extremely slow reverse with max retries
sudo ddrescue -R -d -r 100 /dev/sdb /tmp/image.img /tmp/image.log

# Pass 4: Forward pass again for any missed sectors
sudo ddrescue -d -r 10 /dev/sdb /tmp/image.img /tmp/image.log

Recovering to Sparse File (Save Space)

# Skip blocks of zeros to reduce image size
sudo ddrescue --sparse -D /dev/sdb /tmp/backup.sparse.img /tmp/backup.log

# Useful for flash drives or SSDs with unused space

Direct I/O and Block Size Optimization

# Large block size for faster reads (risky with bad sectors)
sudo ddrescue -b 4096 -D /dev/sdb /tmp/backup.img /tmp/backup.log

# Small block size for maximum precision on bad sectors
sudo ddrescue -b 256 -d -r 10 /dev/sdb /tmp/backup.img /tmp/backup.log

Partial Recovery (Specific Byte Range)

# Start recovery at 10GB mark
sudo ddrescue -s 10737418240 /dev/sdb /tmp/backup.img /tmp/backup.log

# Copy only 50GB starting from position 0
sudo ddrescue -m 53687091200 /dev/sdb /tmp/backup.img /tmp/backup.log

Resume Interrupted Recovery

# Original command was interrupted
# Just run the same command again - ddrescue reads the log
sudo ddrescue -D /dev/sdb /tmp/backup.img /tmp/backup.log

# Progress resumes from last known position
# Automatically retries previously failed blocks

Forensic Imaging Best Practices

Create Hash Verification

# Take SHA256 hash before imaging
sudo sha256sum /dev/sdb > /tmp/source.sha256

# After recovery, hash the image
sha256sum /tmp/backup.img > /tmp/image.sha256

# Compare (won't match due to bad sectors, but useful reference)
cat /tmp/source.sha256
cat /tmp/image.sha256

Dual Destination Backup

# Copy to two locations simultaneously for redundancy
sudo ddrescue -D /dev/sdb /tmp/backup1.img /tmp/backup1.log &
sudo ddrescue -D /dev/sdb /tmp/backup2.img /tmp/backup2.log &
wait

# Ensures at least one copy survives corruption

Document Recovery Metadata

# Create recovery metadata file
cat > /tmp/recovery_metadata.txt << 'EOF'
Source Device: /dev/sdb
Date: $(date)
Drive Model: $(smartctl -i /dev/sdb | grep Model)
Recovery Attempts: 4
Final Status: $(tail -n 1 /tmp/backup.log)
Bad Sectors: $(grep '?' /tmp/backup.log | wc -l)
EOF

Dealing with Bad Sectors

Identify Unrecoverable Blocks

# Extract all bad sector locations
grep '?' /tmp/backup.log | head -20

# Output shows problematic areas
# Use with partition tools to mark as bad

Create Bad Sector Map

# Generate detailed bad block report
sudo ddrescue -i /tmp/backup.log > /tmp/badblocks_report.txt

# Share with recovery service or forensics team
cat /tmp/badblocks_report.txt

Attempt Hardware-Level Retry

# Some drives support retry via SMART
sudo smartctl -t short /dev/sdb

# Wait for self-test to complete
sudo smartctl -a /dev/sdb | grep Self-Test

Performance Optimization

Monitor Recovery Progress

# Watch in real-time with verbose output
sudo ddrescue -D -v /dev/sdb /tmp/backup.img /tmp/backup.log

# Shows read rates and error counts as it progresses

Optimize for Speed vs. Reliability

Goal	Command
Speed	`ddrescue -n -e 10 /dev/sdb image.img log`
Balanced	`ddrescue -d -r 5 /dev/sdb image.img log`
Thorough	`ddrescue -d -r 50 -R /dev/sdb image.img log`
Maximum Safety	`ddrescue -D -d -r 100 -G /dev/sdb image.img log`

Time Estimation

# Calculate estimated time
# Read speed × number of passes × failure rate factor

# Example: 10 GB drive, 50 MB/s, 3 passes, 10% bad sectors
# (10000 MB / 50 MB/s) × 3 × 1.1 ≈ 660 seconds ≈ 11 minutes

Troubleshooting

Device Not Found

# List all block devices
lsblk

# Find your failing drive
sudo fdisk -l | grep /dev/sd

# Use correct device name with ddrescue

Permission Denied

# ddrescue requires root or sudo
sudo ddrescue -D /dev/sdb /tmp/backup.img /tmp/backup.log

# Or use with elevated privileges
su -c "ddrescue -D /dev/sdb /tmp/backup.img /tmp/backup.log"

Output File Already Exists

# ddrescue can append to existing image
# Uses log file to track what's already recovered
sudo ddrescue -D /dev/sdb /tmp/backup.img /tmp/backup.log

# To overwrite completely
sudo rm /tmp/backup.img /tmp/backup.log
sudo ddrescue -D /dev/sdb /tmp/backup.img /tmp/backup.log

Slow Performance

# Disable direct I/O if causing slowdown
sudo ddrescue /dev/sdb /tmp/backup.img /tmp/backup.log

# Or adjust block size
sudo ddrescue -b 1024 -D /dev/sdb /tmp/backup.img /tmp/backup.log

Drive Disconnecting

# Reduce read timeout and retry
sudo ddrescue -e 5 -r 3 /dev/sdb /tmp/backup.img /tmp/backup.log

# Or increase max errors before giving up
sudo ddrescue -e 1000 /dev/sdb /tmp/backup.img /tmp/backup.log

Working with Recovered Images

Mount the Recovered Image

# Find partitions in image
sudo fdisk -l /tmp/backup.img

# Calculate offset (Units × Start sector)
# Example: offset = 512 × 2048 = 1048576

# Mount partition
sudo mount -o loop,offset=1048576 /tmp/backup.img /mnt/recovery

Extract Files from Image

# Using 7-Zip (if partition is FAT/NTFS)
7z x /tmp/backup.img -o/tmp/extracted/

# Or use partition tools
sudo losetup -f -o 1048576 /tmp/backup.img
sudo mount /dev/loop0 /mnt/recovery

Verify Image Integrity

# Check file system
sudo fsck -n /tmp/backup.img

# List recoverable files
sudo find /mnt/recovery -type f 2>/dev/null | wc -l

Integration with Other Tools

Tool	Integration
`fsck`	Repair file systems from recovered image
`ddagent`	GUI wrapper for ddrescue
`GParted`	Partition recovery from image
`TestDisk/PhotoRec`	File recovery from ddrescue images
`EnCase/FTK`	Forensic analysis of images

Legal and Ethical Considerations

Only recover drives you own or have explicit authorization to recover
Maintain chain of custody for forensic recoveries
Document all recovery attempts and results
Follow data protection regulations (GDPR, HIPAA, etc.)
Securely dispose of sensitive recovered data

Comparison with Other Tools

Tool	Speed	Reliability	Flexibility	Learning Curve
`dd`	Fast	Low	Low	Easy
`ddrescue`	Medium	High	High	Medium
`Clonezilla`	Fast	Medium	Medium	Easy
`EWF (EnCase)`	Slow	Very High	Very High	Hard

Resources

GNU ddrescue manual: man ddrescue
Recovery strategy guides
Forensic imaging best practices
NIST guidelines for digital evidence
SANS incident response documentation