DDrescue data recovery

[Powerlines2000]

Hi

I am after some help from those a little more knowledgeable than myself, a little back info.

• I have a 1TB drive, Partitioned (100gb windows 10, 900gb data but only about 400gb used)
  Laptop updated to Win 10 Creators edition and baulked.
  Chkdsk showed 3 bad sectors and wouldn't boot into windows.
  Safe mode, revert etc. wouldn't work.
  Went to reinstall windows and couldn't due to a boot file issue.
  Rebuilt boot file via cmd.
  Went to reinstall windows and discovered only 1 931.5gb partition.
  Laptop stopped recognising the drive.
  IT dept ran drive through an old dos program to detect bad sectors and got the drive recognised again.
  3 bad sectors all at the start of the drive.
  Was advised by testdisk forum to clone the drive using ddrescue
  Tried to clone the drive (shows as 931.5gb) to an USB external 1TB (shows as 931.5gb) drive but it gets to 99.99% and says "ddrescue : write error no space left on device"

Is there any way to slightly reduce the size of the drive clone file as I know that I was only using at max 600gb of the drive or does it not work like that?

I have bought a new 1TB drive for my laptop (to replace the failing one but was loathed to use that to try with ddrescue in case it caused damage to the new drive, Is this a possibility?

Any help would be greatly appreciated.

 

[Jared]

If you got to 99.99% I wouldn't worry too much about it. Unless, it's got a lot of untrimmed area left to read. Most likely the destination drive is slightly bigger than the original. A lot of external drives especially WDs have an HPA set at the end of the drive which makes them slightly smaller than their SATA counterparts.

Before you go crazy trying to re-image the drive, I'd take the clone and run a scan using something like R-Studio to see if it can find and recover the lost partition. You'll probably be good to go.

 

[Powerlines2000]

Thanks so much for the reply, it's driving me a little nuts.

I think the untrimmed was about 6000 (Sorry at work so can't give exact), So hopefully will just be end of the drive?

Is R-studio or Testdisk the best option?

Cheers

 

[Jared]

R-Studio is definitely the better option, as it'll find the partition and then rebuild the folder structure. But, Testdisk is a decent free option that can restore the partition if nothing has been overwritten.

 

[Powerlines2000]

Thanks Jared.

Just because I'm double checking everything with this, ddrescue has only done 1 pass and found 2 errors is it worth doing a second pass with the -a option?

And do you know if there a free run with R-Studio then a pay to recover option like Recuva or pay and pray?

Sorry odd question but money is tight but happy to spend the cash if pretty convinced it will work.

 

[Jared]

The demo of R-Studio will allow you to scan and preview what can be recovered. You only have to pay when you want to actually start saving data out.

I'd pay more attention to the error size, than the number of errors. If it's only a few Kb, it probably won't affect much of anything. If it's several Gb, then you'll probably want to run another pass. However, even on the default setting ddrescue runs three passes and spits the bad areas into smaller pieces to re-read in between the bad sectors.

 

[Powerlines2000]

Great, will give it a go.

Ddrescue says:
ipos: 1000gb
Opos: 1000gb
Non_tried: 20078kb
Rescued: 1000gb

Non trimmed: 65536B
Non_scraped: 0
Bad sector: 0
Bad areas: 0
Read errors: 2

Pct rescued: 99.99%

I have also attached a copy of the logfile.

 

[Jared]

So only about 20Mb unread and it appears to be isolated to two locations on the disk. Since it's closing out on you due to the size difference of the destination you should try re-running it with limiting the size using the -s trigger such as:

ddrescue -s 1000000000000 /dev/sda /dev/sdb /home/liveuser/Documents/recovery.log

That way it'll go back and retry/scrape the unread areas once it thinks it's done. Just use the same log file and it should pick right up on pass 2.

 

[Powerlines2000]

Cool, so just run as before but with that syntax?

 

[jol]

the non cloned sectors might belong to nothing (or something not important), so nothing to worry about
try to check it out