How to recover data from corrupted partitions with ddrescue

What happens when a hard drive starts failing?

When a hard drive suffers physical damage, such as mechanical wear or impacts, the magnetic sectors where files reside begin to fail. In practice, this means the operating system tries to read information and encounters silence or read errors, causing the machine to freeze or corrupt entire partitions. Traditional copy tools, like the cp command, simply give up at the first hurdle or freeze the entire computer.

To avoid catastrophic losses, engineers and system administrators turn to specialized tools capable of extracting maximum data before the media stops working entirely. Just as properly sizing industrial power supplies is vital to prevent electrical spikes that damage hardware, the correct handling of corrupted media requires method and robust tools. It is precisely in this crisis scenario that ddrescue becomes the best friend of anyone needing to rescue vital information.

How does ddrescue work in bit-by-bit cloning?

Ddrescue is a command-line utility for Linux designed specifically to copy data from a file or disk block to another, even when the source media presents serious physical problems. The term bit-by-bit cloning means the software copies every zero and one in the exact same position, replicating the entire disk structure, including empty sectors and damaged partitions.

Unlike ordinary copies, ddrescue divides the process into intelligent scanning phases. In the first phase, called rescue, it quickly reads everything that is intact, bypassing bad blocks. In the second phase, the scraping mode, it tries to recover the pieces left behind, adjusting the read speed to exert minimal stress on the damaged disk's magnetic mechanism.

Preparing the environment and identifying disks

Before running any rescue command, you need to identify with surgical precision which disk is faulty and which one will be the destination where saved data will be written. A typo in this step can overwrite your own files and destroy any remaining chance of recovery. Connect the faulty disk to a stable Linux machine and open the terminal.

Run the lsblk or fdisk -l command to list all units connected to the operating system. Note the device names, usually identified as /dev/sda, /dev/sdb, or /dev/sdc. Make sure the destination disk has storage capacity equal to or greater than the source disk, as the copy requires absolute space to map all blocks.

Running the ddrescue command safely

With the devices identified, the next step is to start the process using the log file, which acts as the operation's black box. The log file records exactly which sectors have already been successfully copied and which ones failed, allowing you to pause and resume the process at any time without losing previous progress.

The basic command structure requires the source, destination, and log file. Type the instruction in the terminal replacing the generic names with the real identifiers of your hardware, taking extreme care not to invert the source and destination during typing.

ddrescue -d -r3 /dev/sdb /mnt/backup/rescued_disk.img /mnt/backup/mapfile.log

In this command, the -d flag enables direct disk access without going through the operating system cache, while -r3 dictates that the program will try to read problematic sectors three times before definitively giving up on that specific block.

Interpreting progress and the log file

During execution, ddrescue displays a colorful and dynamic screen with detailed statistics about the rescue. You will see total data copied, current read speed, the number of corrupted sectors found, and the estimated time to finish the cloning operation.

If speeds drop drastically or if the disk starts making strange mechanical noises, it is wise to pause the process by pressing Ctrl+C and let the disk rest for a few minutes to prevent the read head from locking up permanently. Just like in complex real-time infrastructure monitoring routines, tracking performance indicators and errors prevents unpleasant surprises along the way.

Validating recovered data and restoring partitions

Once ddrescue finishes scanning and scraping sectors, you will have an image file containing an exact copy of the damaged disk. The next step is to mount this image in the operating system to check if critical folders and files are accessible and intact.

Use the losup command to associate the image with a virtual loop device and then mount the desired partition into a temporary folder. If the file system is heavily damaged, you can still apply additional logical recovery tools, such as TestDisk, directly over the cloned image file, protecting the original hardware from further wear.

Final considerations on data rescue

Recovering corrupted partitions with ddrescue requires patience, technical rigor, and above all, respect for the physical limits of failing hardware. Trying to rush the process or using inappropriate software on the first attempt is usually the fatal mistake that seals the final destiny of lost information. Mastering this tool and maintaining a proactive backup routine ensures unexpected mechanical failures stop being a corporate or personal nightmare.