DDRescue help please

[orion23]

Hello guys!

I'm trying to copy data from a failing 3TB seagate drive (yes one of those defective seagate drives), using the following comand from a rescue disk:

sudo ddrescue -v -r 3 /dev/sda /dev/sdb logfile

1: Where is the logfile being created / stored ? ( i didn't specify a 3rd drive as destination)

2: If I were to stop, how could I resume ? I actually had to add --force to the beginning of the command in order to proceed

3:I see a line where it says that 1834 GB have been rescued
then a 2nd line that says 1958 GB have been rescued (is that the 2nd pass)

4: What happens if I stop this right now? will I have access to what has been rescued ?
Or will I just lose everything



Thanks!

 

[Elixer]

Hello guys!

I'm trying to copy data from a failing 3TB seagate drive (yes one of those defective seagate drives), using the following comand from a rescue disk:

sudo ddrescue -v -r 3 /dev/sda /dev/sdb logfile

1: Where is the logfile being created / stored ? ( i didn't specify a 3rd drive as destination)

2: If I were to stop, how could I resume ? I actually had to add --force to the beginning of the command in order to proceed

3:I see a line where it says that 1834 GB have been rescued
then a 2nd line that says 1958 GB have been rescued (is that the 2nd pass)

4: What happens if I stop this right now? will I have access to what has been rescued ?
Or will I just lose everything



Thanks!

Logfile would be generated in the directory that you ran that command in.
You can specify a starting location via --input-position=bytes.
If you stop now (and you shouldn't, unless you have a good reason), you would have incomplete data on some stuff.
No way to tell which file would be whole, and which ones would only have parts of the data.
So, unless you know what you are doing, it is better to let it finish. You could stop it, then restart it, from a bit before the location where it left off, but, once you start a salvage operation, you need to let it finish, since the bad drive could die on you at ANY time, so you want to get as much data as possible, as quickly as possible.

 

[orion23]

Thanks for your reply

I ran the command from a live disc, no way a log is being created and only now I realize I should have used a 3rd disk to store such logfile
The tutorial I followed was missing a couple of details

I believe this process is a "clone" image and stopping it could mean losing everything

I only ask about canceling because it has slowed down to bytes and it's been 4 days now

 

[Essence_of_War]

Hmmm...a log may be being created, it just might not be committed to disk, that is, it's being written to a tmpfs mounted in memory.

If you can see the logfile, try opening up a new terminal and typing

ls -lh

and seeing if you see the name of the logfile. I'm guessing here that you didn't change directories at all before typing in the ddrescue command, so the logfile will be on the default path of the terminal.

2: If I were to stop, how could I resume ? I actually had to add --force to the beginning of the command in order to proceed

As long as you have the logfile, the original drive (/dev/sda) and the aborted clone (/dev/sdb) you could resume by just executing the same command giving the path to the original, the would-be-clone, and the logfile. In fact, this is sort of a standard practice when using ddrescue, for example:

https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html

ddrescue -f -n /dev/sda /dev/sdb mapfile      
ddrescue -d -f -r3 /dev/sda /dev/sdb mapfile

The first command does attempts to image sda to sdb writing a log of sectors to 'mapfile'. The -n flag indicates that the 'scrape' phase should be skipped, so it won't waste any time trying to copy data from difficult to read sectors, but it will log them as difficult sectors to the mapfile, as well as any sectors that were successfully recovered, so that in further with the same disk,clone and mapfile you won't waste any time copying data from sectors that have already been rescued.

The second command will try to scrape data from the difficult sectors and will make three retries (-r3) for each sector and will also use direct disk access (-d) to bypass any sort of in-memory cache.

The force command is normal if you're using a partition (/dev/sdb) as your output instead of a disk image file. It's there to protect you from accidentally blowing away one of your good disks without REALLY MEANING TO.

3:I see a line where it says that 1834 GB have been rescued
then a 2nd line that says 1958 GB have been rescued (is that the 2nd pass)

That sounds like normal output as it resolves each of the successive passes.

4: What happens if I stop this right now? will I have access to what has been rescued ?

Or will I just lose everything

You'll have access to what has been rescued. But depending on what exactly has been rescued that could be almost everything, almost nothing, or something inbetween. To figure out what you've got, you'll need to try things like mounting a filesystem (if it exists) or running testdisk/photorec on the volume. I wouldn't do anything to the clone of the dead disk. IF this data is valuable, you should contact a recovery service. If it's not, and/or you're determined to press onward on your own, my recommendation would be to make an additional copy of the cloned disk (/dev/sdb). Then try your recovery work on that (testdisk/photorec if you're trying to recover files and the filesystem won't mount, for example). This way you'll retain a backup in case you mess something up, or you want to give up and try calling in a professional.

 

[orion23]

Thank you very much for your help.
The data here is not so important or critical, but information / files I'd like to keep if possible.
I'm gonna be patient and wait for 1 or 2 days and see if it completes the cloning
Thanks again!