[clug] Recovering data from old disks. Max age observed?

[Eyal Lebedinsky]

On 15/6/19 11:02 pm, George at Clug via linux wrote:
> 
> 
> On Saturday, 15-06-2019 at 19:17 Eyal Lebedinsky via linux wrote:
>> On 15/6/19 6:48 pm, steve jenkin wrote:
>>> Eyal,
>>>
>>> No idea - ran ‘ddrescue’ with defaults.
>>
>> The default is 3 passes.
>>
>> I recently rescued a small HD, initially showing 3 bad sectors and after a few 100 pass runs.
>> This is what the last mapfile showed:
>>
>> # Mapfile. Created by GNU ddrescue version 1.22
>> # Command line: ddrescue /dev/sda /home/partimag/ea-sda.dd /tmp/dd.map -d -r100 -vv
>> # Start time:   2019-05-21 03:34:38
>> # Current time: 2019-05-21 03:41:06
>> # Finished
>> # current_pos  current_status  current_pass
>> 0x697A0F000     +               100
>> #      pos        size  status
>> 0x00000000  0x697A0EE00  +
>> 0x697A0EE00  0x00000200  -
>> 0x697A0F000  0xC0A507000  +
>>
>> The second last line shows one (0x200 bytes) bad (-) sector.
>>
>>> no paramaters bar source & destination.
>>>
>>> Those are really handy options it has - thanks very much,
>>> Next drive I try to recover, I’ll look at the options more closely.
>>>
>>> I was impressed with only 17 errors.
>>
>> Each pass attempts to rescue only the failed sectors, so very quick.
>> However, you should always use a mapfile (3rd positional arg) to allow doing more passes in followup runs.
>>
>> I use something like:
>> 	sudo ddrescue /dev/sdX rescue-sdX.dd rescue-sdX.map -d -r100 -vv
> 
> Not having used ddrescue, if you have time, please do explain the above, particularly what rescue-sdX.dd rescue-sdX.map are ? (Rescued image file and log file?)

Yes, the three positional args are
	device to read
	file to write
	mapfile to read then write

> What do you do with the image file?  Can you mount it to check if it is readable?  If so, how?

The usual next step is to write the image to a good disk.
However you can mount the recovered file partitions, something like
	mkdir test-partition
	sudo mount -o ro,loop,offset=$((512*61440)),sizelimit=$((512*999424)) rescue-sdX.dd test-partition
where '61440' and '999424' are partition sector offset/size from 'fdisk -l /dev/sdX' or such.

You can even mount it rw and do some cleanup (fsck etc.), but do keep a copy of the original rescued image.

HTH

> https://www.forensicswiki.org/wiki/Ddrescue
> Partition recovery
> Kernel 2.6.3+ & ddrescue 1.4+
> 
> ddrescue --direct will open the input with the O_DIRECT option for uncached reads. 'raw devices' are not needed on newer kernels. For older kernels see below.
> 
> First you copy as much data as possible, without retrying or splitting sectors:
> 
> ddrescue --no-split /dev/hda1 imagefile logfile
> 
> Now let it retry previous errors 3 times, using uncached reads:
> 
> ddrescue --direct --max-retries=3 /dev/hda1 imagefile logfile
> 
> If that fails you can try again but retrimmed, so it tries to reread full sectors:
> 
> ddrescue --direct --retrim  --max-retries=3 /dev/hda1 imagefile logfile
> 
> You can now use ddrescue (or normal dd) to copy the imagefile to a new partition on a new disk. Use the appropriate filesystem checkers (fsck, CHKDSK) to try to fix errors caused by the bad blocks. Be sure to keep the imagefile around. Just in case the filesystem is severely broken, and datacarving tools like testdisk need to to be used on the original image.
> 
> https://www.hamishmb.com/html/Docs/ddrescue-gui/basicfunctionality.html
> 
> https://www.technibble.com/guide-using-ddrescue-recover-data/
> 
> https://www.tutorialspoint.com/unix_commands/ddrescue.htm
> 
> http://www.softpanorama.org/Utilities/ddrescue.shtml
> 
>> -d	use direct disc access for input file
>> -r100	exit after 100 retry passes
>> -vv	be very verbose, nice to see if bad sectors shrink
>>
>>> Filesystem passed fsck and other checks, so not fussed with losses.
>>
>> Good, bad sectors are often in unused sections of the fs (a mapfile shows where the bad sectors are).
>>
>> cheers
>>
>>> s
>>>
>>>> On 15 Jun 2019, at 09:57, Eyal Lebedinsky via linux <linux at lists.samba.org <mailto:linux at lists.samba.org>> wrote:
>>>>
>>>> How many ddrescue passes did you use? I found that using a large number (say 500)
>>>> recovered many bad tracks for me when a disk goes funny.
>>>>
>>>> Of course, one may rarely get a false positive.
>>>>
>>>> cheers
>>>>
>>>> [trimmed]
>>>>
>>>> --
>>>> Eyal at Home (eyal at eyal.emu.id.au <mailto:eyal at eyal.emu.id.au>)
>>>
>>> --
>>> Steve Jenkin, IT Systems and Design
>>> 0412 786 915 (+61 412 786 915)
>>> PO Box 38, Kippax ACT 2615, AUSTRALIA
>>>
>>> mailto:sjenkin at canb.auug.org.au http://members.tip.net.au/~sjenkin
>>
>> -- 
>> Eyal at Home (eyal at eyal.emu.id.au)

-- 
Eyal at Home (eyal at eyal.emu.id.au)