Member Avatar for tony75

Hi
I have 500GB WD my passport with bad sector, I try to take disk imaging for forensics investigation with ddrescue but ddrescue was very slowly, is it really take 131d 22h?
Is there any command or way that I can use to speed up ddrescue and just take 8 to 10 hours?
I will appreciate your help.

root@lab:/home/lab/Desktop# ddrescue -d -r 3 /dev/sdc1 WD.dd wd.log
GNU ddrescue 1.22
     ipos:    4980 kB, non-trimmed:        0 B,  current rate:       0 B/s
     opos:    4980 kB, non-scraped:        0 B,  average rate:   57915 B/s
non-tried:  500068 MB,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    4980 kB,   bad areas:        0,        run time:      1m 25s
pct rescued:    0.00%, read errors:        0,  remaining time:    131d 22h
                              time since last successful read:          0s
Copying non-tried blocks... Pass 1 (forwards)^C
Edited by tony75
  • 2 Contributors
  • 9 Replies
  • 2K Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by tony75

Dani AI

Generated

the scary ETA is just ddrescue extrapolating from a tiny sample. The fastest workflow is to grab all easy sectors first, then come back for the slow/bad areas. Also, for forensics, image the whole disk (e.g., /dev/sdc), not just the partition (/dev/sdc1), so you capture partition tables, slack, and unallocated space.

Try this three‑pass approach (new empty outfile and a mapfile are assumed):

# 1) Fast pass: copy all readable data, skip the hard stuff
ddrescue -n -S /dev/sdc WD.img wd.map
# 2) Retry pass: use direct reads and a few retries to nibble the tough spots
ddrescue --idirect --retry-passes=3 /dev/sdc WD.img wd.map
# 3) Reverse pass: sometimes sectors read from the other side
ddrescue --reverse --retry-passes=1 /dev/sdc WD.img wd.map

Notes that speed things up:

  • Use -n first to avoid time‑sinks in trimming/scraping; then add retries. This two‑step pattern is the author’s own example. (gnu.org)
  • --idirect can help on flaky media, but may be faster or slower; that is why it is suggested after a quick first pass. (gnu.org)
  • -S creates a sparse image so unknown/bad ranges are holes instead of writing zeros, saving time and space; only use it with a new/zeroed outfile. (gnu.org)
  • If progress stalls in one direction, a --reverse sweep sometimes succeeds. (gnu.org)

For evidence handling: set the source read‑only if you lack a hardware write blocker, e.g. blockdev --setro /dev/sdc. (man7.org) And remember that a proper forensic image is a bit‑for‑bit copy that includes free and slack space, which is why whole‑disk imaging matters. (csrc.nist.rip)

’s point about hardware imagers is spot‑on: when a USB bridge keeps resetting or the drive times out constantly, tools like those can finish jobs that software alone cannot. If your run keeps dropping to 0 B/s after the fast pass, that is usually the cue to escalate.

Recommended Answers

All 9 Replies

Member Avatar for tony75

It was really very interesting but it was not answer for my question!

Member Avatar for rproffitt

@tony, I think it is an answer. Over the past few years I've been seeing a lot of iffy drives and been looking for reasons and methods to get the data out.

I forgot to mention another common tool we use. RECUVA. Free and plenty of tutorials on the web.

Adding with edit: I didn't mention anything from https://www.google.com/search?q=ddrescue+skip+bad+sectors

Edited by rproffitt because: Add PS.
Member Avatar for tony75

Thanks again for answer
The problem is there drive letter for WD unable to detect in windows but shown in Diskmanagment as unallocated disk but in linux show it
I try to reover it unallocate partition with sevral powerful tools but got error becsue of badsector so my solution is just use linux to take an image on WD har driver with bad sector!
So I don't know should I use dd (dd if=/dev/old_disk of=image_file conv=noerror) or ddrescue?
ddrescue take very long time?or mybe there is ddrescue command that save my time!

Edited by tony75
Member Avatar for rproffitt

I was unclear. As a rule I don't duplicate the web but share what I'm using and am looking into. That is, I want what I write to be unique and not what you can google. If you want to lookd into ddrescue and bad sector workarounds, check that google I gave above.

But another nod to Deepspar's nearly automatic fixer for drives that delay to register or read badly. Watch that video about it.

Member Avatar for tony75

DeepSpar is wonderful because it can recover data from bad sector not just skip it but the problem is it's very expensive!

Member Avatar for rproffitt

I wonder if you watched the video and heard the advice not to buy the Deepstar unit but find a shop that would connect it and push the button? That way it's not thousands of bucks.

I find a lot of folk are still not backing up what they can't lose. I see 1TB drives for under 39USD and recovery of what you can't lose costs hundreds. Backups are cheap, recovery is time consuming, not always do it yourself and costly. Usually it takes a big loss for folk to figure this out.

More videos about recovery at:
https://www.youtube.com/watch?v=TIwbndHTp_8
https://youtu.be/tNUsoangGFs

In my town we have those 300 dollar data recovery shops. They have those deepspar units.

Member Avatar for tony75

Wow nice video..
For data recovey I usually us Testdisk,foremost or Scalpel in linux
Autopsy or FTK

Member Avatar for tony75

Using testdisk in linux can recover files from bad sectors hard driver

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.