Question about dd-rescue (sorry, this may be a re-post...)

[yonatan]

Hi,

Does anyone know what dd-rescue does with the "holes" -- i.e. does it fill them with junk and preserve the offset of the readable data that follows?

Basically, I'm using Knoppix to rescue my wife's damaged NTFS partition. Her operating system won't even boot, but I'm able to view the files with Knoppix and copy them to another system over a network or just burn them directly with k3b.

However -- some of the files can't be read (I/O errors -- presumably why her operating system can't mount the partition). More specifically -- _parts_ of those files can't be read. I would like to try to retrieve these files anyway. What I want to do is, for each file, to wind up with a file of the same length, along with any data that could be copied from the damaged file in its right offset. Granted, there would be "holes" in each file, for the parts that couldn't be read. But I don't think it would do me much good if the "holes" were dropped -- because then the offset would be wrong from anything after the first hole.

Are there any other tools I should look at?

Thanks,
Yonatan

Note: This may be a re-post; I fogot to enter a subject the 1st time and couldn't find my post on the forum.

[yonatan]

I think I found the answer in good old dd itself --

"In 6.5 and beyond, use dd conv=ignerror, to have it do all the hard work itself, and also write zero's on the destination blocks that can't be read from the source."

Can anyone confirm?

Thanks,
Yonatan

[yonatan]

Yes, it's right there in the dd man page:

ignerror Do not stop processing on an error at all. Unlike
noerror, the read errors are skipped over if possible, by
using lseek64(2), (if possible) and there is no limit on
the number of errors. It is recommended that either ibs
or bs be used, and set to the minimum size for the input
device, in order to minimize the skipped data. This can
sometimes allow disk drives to be copied even if they
contain unreadable blocks, although the output copy will
of course have blocks of missing (zero-filled) data.

The quetion is, what number do I specify for bs for a hard drive (i.e. how do I know what the minimum size)?

[shah]

Since it's ntfs partition I would suggest you to try repair those bad sector first using xp cd. Boot to Recovery console and try chkdsk /f or chkdsk /r.

[yonatan]

Thanks for the suggestion, but the first thing I did was to Google "Unmountable boot volume" and that came up with the Windows recovery console and CHKDSK. The problem is that CHKDSK failed with unrecoverable errors after 33 percent, and when I tried to Dir the C: drive from that so-called recovery console it said "failed to enumerate folders." Fortunately, Knoppix has no problem mounting the partition. Some files cannot be read because of I/O errors. I'm not sure if this means that there is a _physical_ problem with the drive or a _logical_ problem with the file system, but I'm afraid that it sounds like the former. Once I get all of the important data off of it, I'll need a way to try to figure out if there are physical problems with the drive. (I'll leave that exercise for a different post...)

Anyway, the dd included in Knoppix 3.6 doesn't seem to have the ignerror feature (but just the noerror feature.) So that leaves me with dd_rescue.

[shah]

I personally use hd regenerator to recover bad blocks, and recently I tried a new salvationdata sector recovery utility to repair my dead maxtor hd. Amazingly that hd is back alive.
http://www.salvationdata.com/

By the way, you might want to try using dd_help. I never use dd_rescue, But from what is written, it will help you with dd_rescue.
http://www.kalysto.org/utilities/dd_rhelp/index.en.html

[yonatan]

I tried dd_rescue and it worked great. I successfully recovered a 500 MB Outlook personal folders file. There were several i/o errors towards the end of the file, but Outlook opens it without trouble and the data is there.

Anyway, thanks for those links, I'll need that info soon. BTW I am using a Maxtor.

[Dark Templar]

Oh hey, you guys seem to know HOW THE HELL this can be done, so please, I beg you because I'm really not good at those things - PLEASE HELP ME!

My HDD crashed just a few minutes ago and WinXP doesn't boot anymore, saying that it can't initialize process1 (well, whatever that means...). So I tried CHKDSK, but it stops at 50% and doesn't even post an error message. After that, I tried Knoppix and now I'm here and don't know what to do - usually I don't use Linux, you know. However, I was able to mount drive c, but there are only two folders left (with nothing really important in them) - everything else, all my programs, system directories and work seem to be gone. When I accessed the same drive with the Midnight Commander, it posted an error message, saying that it couldn't show these directories because they didn't exists. Well, due to the fact that the MC knew about the names, I figure that there is an error within the file-allocation-table or something like that.

This so far is my problem. I heard that I could recover such file losses with dd_rescue, but I have no idea how to use it. Could you give me something like an 'instruction-on-how-to-get-this-done-as-fast-as-possible'? Or is there a better method than using dd_rescue? Anything? Please, I beg you so much, I have to recover this data, heeeelp me.