Home > Mac administration, Unix > Using ddrescue on a failing hard drive

Using ddrescue on a failing hard drive

While I was out at MacIT last week, our Casper server sent me a notification that the “Check for failing hard drive” smart group had a member. Since that’s a club that nobody wants to be a part of, I forwarded the notification to the team at home to let them know. They were able to copy the user’s home folder data off to the server and left the box itself and its failing drive for me to take a look at when I got home.

Once I took a look, the SMART status report of Failing and the weird noises from the drive made me certain that it was only a few steps short of the Choir Eternal. However, I still wanted to see if I could get the maximum amount of data off of it before its final demise. Time for ddrescue.

Installing ddrescue

I had a bootable utility disk and a separate drive named Backup with enough storage to hold the complete contents of the failing drive. Now I just needed to install ddrescue on the utility drive. To do this, I installed MacPorts on the utility drive and then installed ddrescue.

1. Installed MacPorts from http://www.macports.org

2. Following installation, ran the following command to get MacPorts up to date:

sudo port -v selfupdate

3. Next, ran the following command to install ddrescue:

sudo port install ddrescue

Running ddrescue

1. Get the information on the drive you want to recover from by running the following command:

diskutil list

For the purposes of this example, we’ll assume that the failing drive is /dev/disk0s2

2. Use the following command to have ddrescue recover data using verbose mode to a disk image on the Backup drive:

sudo ddrescue -v /dev/disk0s2 /Volumes/Backup/failing_drive_backup.dmg failing_drive_backup.log

The failing_drive_backup.log part of the command will create a log file that ddrescue writes to. In the event that you need to stop ddrescue and start it again, ddrescue will read the log and use the information to pick up where it left off.

Monitoring ddrescue

Using the “-v” flag in ddrescue means that ddrescue will display its output in verbose mode. It should look similar like this:


About to copy 9223 PBytes from /dev/disk0s2 to /Volumes/Backup/failing_drive_backup.dmg
Starting positions: infile = 0 B, outfile = 0 B
Copy block size: 128 sectors
Sector size: 512 bytes
Max retries: 0
Direct: no Sparse: no Split: yes Truncate: no

Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued: 0 B, errsize: 0 B, errors: 0
Current status
rescued: 69792 MB, errsize: 0 B, current rate: 18153 kB/s
ipos: 69792 MB, errors: 0, average rate: 18429 kB/s
opos: 69792 MB, time from last successful read: 0 s
Copying non-tried blocks...

You can also use fs_usage to monitor ddrescue‘s read/write progress by using the following command:

sudo fs_usage | grep ddrescue


Recovery

Once your data has been recovered to the disk image, hopefully you can double-click on it and have it mount. However, in the event it does not, you can try restoring from the disk image to another disk partition using the following steps.

1. Get the information on the drive you want to recover from by running the following command:

diskutil list

For the purposes of this example, we’ll assume that the drive we’re restoring to is /dev/disk1s3

2. Use the following command to have ddrescue recover data using verbose mode from the failing_drive_backup disk image on the Backup drive to  /dev/disk1s3:

sudo ddrescue -v /Volumes/Backup/failing_drive_backup.dmg /dev/disk1s3 recovery_drive.log

Once on the disk partition, you should be able to run whatever repairs are needed to get the drive to mount and access your files.

Update 2-3-2012:

When recovering data to a drive, you may receive the following message:

ddrescue: Output file exists and is not a regular file.
ddrescue: Use `--force' if you really want to overwrite it, but be
ddrescue: aware that all existing data in output file will be lost.

In this case, the output file is your destination drive and ddrescue has detected that it’s an existing partition. If you’re certain you want to write to it, use -f to force overwriting of the existing partition:

sudo ddrescue -v /Volumes/Backup/failing_drive_backup.dmg /dev/disk1s3 recovery_drive.log -f


Categories: Mac administration, Unix
  1. Christian Schwang
    December 31, 2012 at 9:31 am

    Hi,

    a few small tips for ddrescue usage:
    – instead of /dev/disk{x} you may use /dev/rdisk{x} – This will give a massive performance boost (in my testing transfer rate went from 30 MB to 130 MB). For detailed reason you may want to look at: http://lists.apple.com/archives/filesystem-dev/2012/Feb/msg00015.html

    – on newer hard drives (or SSDs) you might want to specify the block size (sector size) using “-b {block size}”. Newer hard drive usually use 4096 bytes per sector instead of 512 (ddrescue default). Those drives are usually called “advanced format” or something like that. Specifying the correct sector size can make imaging broken drives faster.

    – to further increase performance you can increase the cluster size (sectors to copy at a time) via “-c {cluster size}”. I usually get the best results with cluster size of 4096 to 16384. In my case the transfer rate went from 130 MB to 180 MB.

    Cheers, Christian

  2. March 15, 2013 at 7:36 am

    Hi guys. I have used dd_rescue on my defect laptop hdd. Its now been running for 50+ hours, and I wonder if the output file (.dd) Will be affected by me aborting the operation by pressing ctrl+c. I forgot to use the -log option in the command. Please advise. Best Regards, newbee

  3. pruthe
    June 27, 2013 at 2:47 am

    I had a hard drive (data only) on my Mac OSX 10.7 (Mac Pro) system which apparently had errors. Errors were in VMWare Fusion 4 data file for virtual Windows XP. I could not boot up/resume virtual Windows XP and kept getting error from Fusion about bad data encountered. Could not correct with Disk Utility or Disk Warrior. As a last resort, I tried following above procedure and to my surprise, ddrescue found 2 disk errors and corrected. I’m now using my virtual Windows XP again.

    Thanks so much for posting. Much appreciated!!! :-)

    Paul

  4. garegin
    July 17, 2013 at 2:32 am

    instead of getting macports.http://archive.hmug.org/BSD/Administration/System/ddrescue/ has the ddrescue binaries ready to download.

  5. gjones
    May 27, 2014 at 3:30 pm

    you can easily install ddrescue with homebrew

  6. August 13, 2014 at 9:35 am

    Hello, guys! Can you help me, with an advice.

    I had a OCZ Vector4 256Gb with FileVault2 enabled, drive failed but i was able to make an image with ddrescue. Then i bought Samsung EVO840 500Gb, i made one large partition and restored image to that partition, however MacOSX doesn’t recognize this partition.
    Disk Utility verify disk says “Invalid B-tree node size” and can’t be repaired.

    What am i doing wrong and how i can get this image back to real disk?

    Thanks.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 155 other followers

%d bloggers like this: