GNU ddrescue

Information

gddrescue is one of the preinstalled packages for our r/Techsupport Rescue Media. If you are using this live image, you can skip the installation section.

How to install gddrescue

Refer below for installation instructions if you are not using our live image or want to install it on your own system.

Installing gddrescue

Debian / Ubuntu / Linux Mint:

sudo apt update && sudo apt install gddrescue

Fedora / RHEL / CentOS / AlmaLinux:

sudo dnf install ddrescue

Arch / Manjaro / CachyOS:

sudo pacman -Syu ddrescue

Important

The command may point to a ddrescue binary even though the application is called gddrescue. For the rest of the guide, we will refer to the package as ddrescue.

Basic usage

What gddrescue does

GNU ddrescue (package ddrescue) reads from a source (failing disk or partition) and writes to a destination (image file or another disk) while recording everything in a logfile (mapfile).

Basically, it works like this:

• It automatically skips unreadable areas first and copies good data quickly, instead of getting stuck on the first bad sector.
• The logfile tracks which blocks were good, bad, or untried so you can stop and resume later without losing progress.
• You usually image the failing drive to a file, then work on the image with other tools (fsck, testdisk, photorec, etc.), not on the dying drive.

Important: Identifying the source and destination drives.

Caution

Read this section very carefully before using any form of data recovery software!

Please refer to this guide on how to identify your drives in Linux: How to identify failing drives in Linux.

Always double-check which drive is source and which is destination before running gddrescue, because mixing them up can destroy your only copy of the data.

Running gddrescue: Clone to image file

The canonical simple pattern is: first quick pass with no retries to grab all easy data, then optional later passes to retry bad areas.

Step 1: Quick image to a file (no retries)

Example: source /dev/sdX, destination image /mnt/backup/disk.img, logfile /mnt/backup/disk.log:

sudo ddrescue -n /dev/sdX /mnt/backup/disk.img /mnt/backup/disk.log

What this does:

• -n tells ddrescue to avoid scraping and retries for now; it copies all readable blocks as quickly as possible, skipping areas that cause errors.
• The logfile disk.log records which blocks are good, bad, or pending so you can resume later.

You can stop this with Ctrl+C; ddrescue will save progress to the logfile so you can run the same command again and it will continue.

Step 2: Optional retries on bad areas

Once the quick pass finishes, you can attempt to recover more data from the problematic areas:

sudo ddrescue -d -r3 /dev/sdX /mnt/backup/disk.img /mnt/backup/disk.log

• -d uses “direct” disk access, bypassing the kernel cache, which can help with some failing drives.
• -r3 tells gddrescue to retry bad sectors up to 3 times; you can adjust the number, but extremely high retry counts can be risky and very slow.
• It reuses the same logfile so it only works on previously failed or unfinished blocks.

If the disk is in very bad shape, you might prefer -r1 or even no retries at all to minimize stress.

Running gddrescue: Cloning directly disk-to-disk

Sometimes you want a clone on another physical drive rather than an image file. The command is similar, but the destination is a disk instead of an image:

Example: source failing disk /dev/sdX, destination healthy blank disk /dev/sdY (must be same size or larger):

Step 1: Quick pass, no retries:

sudo ddrescue -n /dev/sdX /dev/sdY clone.log

Step 2: Optional retries:

sudo ddrescue -d -r3 /dev/sdX /dev/sdY clone.log

WARNING

• You must be absolutely sure /dev/sdY is the target you are willing to overwrite completely. This command will destroy any data on /dev/sdY.
• Some guides recommend using -f when the destination is a block device to force overwriting; on some systems ddrescue will refuse to write to a block device without -f.

Once again, disk-to-image is generally safer. You can always write the image back to a new disk later if needed.

Importance of the logfile (mapfile)

The logfile (often called mapfile) is a critical part of gddrescue’s operation. It tracks the status of each block of data.

• You must specify the same logfile every time you work on a given source-destination pair.
• The logfile records which blocks are finished, failed, or pending; gddrescue uses this to avoid re-reading good areas and to focus on bad regions.
• If the system crashes or you stop gddrescue, you can simply rerun the last command and it resumes from where it left off using the logfile.
• Tools like ddrescueview can graphically show you which parts of the disk were recovered successfully.

Always keep the logfile on a healthy disk (for example, next to the image file).

After imaging: Working with the image

Once you have an image, you generally stop touching the failing disk and work only on the image. You can mount the image, run filesystem checks, or use recovery tools like testdisk or photorec on the image file to try to recover files.

Typical next steps (examples, not full tutorials):

1. Try to mount the image read-only (for a whole-disk image):
   • Create a loop device and maybe use kpartx or losetup to expose partitions, then mount the relevant partition read-only.
2. Run filesystem checks (fsck) on the cloned disk or on a copy of the image, not on the original.
3. Use file recovery tools (testdisk or photorec) on the image file to try to recover files.

Basically the pattern to follow is “gddrescue -> image file -> run other recovery tools on that image”.