Padding

Both tools replace unreadable locations in the image file with zeros. Although this method might make it impossible to save the full structure, you might at least rescue part of it. Because the image generated by ddrescue can be extremely large, you need to save it to a partition that can deal with these chunks of data. This means that external USB hard disks with FAT32 filesystems are not suitable.

The following example copies the content of the /dev/sde1 partition to /home/tim/copy.img:

ddrescue /dev/sde1 /home/tim/copy.img logfile

This command stores information in logfile that allows you to interrupt the copy with Ctrl+C and then continue later with the same command (Figure 4). You can also save the entire disk, rather than just the sde1 partition:

Figure 4: Even though you can interrupt ddrescue and carry on copying later, it makes more sense to avoid interruptions if possible. With hard drives, in particular, you might only have one chance, depending on the damage profile.

ddrescue /dev/sde /home/tim/copy.img logfile

This command makes sense in particular if blkid does not recognize any partitions or if you know that the partition table is damaged. If possible, you should create a copy of the image you create. If rescue attempts fail, at least you do not need to waste time reading the faulty disk again. On a more granular level, if you cannot read an individual file, you can at least save its readable parts with the

ddrescue file.txt /media/rescue/file.txt

command.

Cliffhanger

Once you have used ddrescue to back up a partition, you can try to mount the partition. The following command mounts it as read-only in the /mnt directory for safety's sake:

mount -o loop,ro /home/tim/copy.img /mnt

Now back up all the important files from the /mnt directory. In the case of the memory card from the camera, a few photos have already appeared again below /mnt. After quickly checking with the photographer, it seems that more than half the shots are still missing. So, now it's time to fire the big guns, which only work on umounted media; in other words, time to umount /mnt.

Checker

If the partition in question uses an ext filesystem, you can now use the command fsck to fix it:

fsck.ext3 -p copy.img

The parameter -p tells fsck to correct the problems directly. On an ext4 filesystem, you would use fsck.ext4 instead of fsck.ext3. Similarly, fsck.vfat repairs partitions with a FAT32 filesystem, which is used on USB sticks and SD cards. Once fsck has completed its work, you can mount the image as before and read the files.

Similar repair tools exist for other filesystems. On NTFS filesystems, for example, ntfsfix will help; it is part of the ntfsprogs collection, which in turn is part of the NTFS driver. The tool is therefore installed by default on most distributions, so that the ntfsfix copy.img command will fix the image directly.