XPost: aus.computers   
   From: nospam@needed.invalid   
      
   On Tue, 11/25/2025 5:55 PM, Felix wrote:   
   > Computer Nerd Kev wrote:   
      
   >   
   >> and make a disk image.   
   >   
   > how can I make an image of a disk that can't be read?   
      
   The partition cannot be mounted.   
      
   That limits what it is safe to do.   
      
   *******   
      
   This leaves a sector-by-sector treatment of the entire disk as an option.   
      
   And not just any old sector-by-sector treatment.   
      
   The tool must be tolerant of CRC errors (because we think   
   we can already seen a CRC error right at the beginning of the disk drive).   
   Many backup programs for example, they hate CRC errors, and attempts   
   to transfer a disk with them, stop practically instantly.   
      
   That is what ddrescue (gddrescue package) is for.   
      
   It is a copy of disk dump "dd", where CRC errors are handled   
   without the transfer stopping.   
      
   ddrescue can   
      
      transfer from one disk to another disk  (works best if disks are same size,   
   because   
                                               of a GPT secondary partition table   
   handling issue)   
      
      transfer from one disk to a .img file   (this can serve as the reference   
   copy of the   
                                               bad drive, while you do   
   file-by-file recovery)   
      
   The ddrescue command keeps track of which sectors had CRC   
   errors and were not read on the first pass.   
      
   Subsequent runs of the command, as long as they use the same   
   source-dest pair, can add to the buildup of a "recovered" image.   
      
   On the subsequent runs, only the CRC-errored sectors are probed   
   to see if they are readable. Thus, the approximate runtime   
   is longest for the first run, shorter for the subsequent runs.   
      
   You stop attempting to ddrescue, when the command is not able   
   to resolve the errored sectors after repeated trials.   
      
   *******   
      
   Pre-conditioning of drive /dev/sdf    # This is the empty, known-to-be-good   
   drive   
      
   # You want to erase all the sectors, such that any sectors that are non-zero   
   # later, you know for sure they came from the bad drive, and are not left over   
   # data from somewhere else. This level of care is needed, if running a   
   file-by-file   
   # data recovery program later.   
      
      sudo fdisk /dev/sdf   
      p                      # print details of the recovery drive (there is a   
   "size" field)   
      q                      # quit the command without making changes   
      
      sudo if=/dev/zero of=/dev/sdf bs=221184   # Usually 221184 divides evenly   
   into drive size   
                                                # This could take several hours.   
      
   *******   
      
   With the minty-fresh /dev/sdf, we now begin the attempt to copy the data.   
      
   This is a sector by sector copy, that does not care whether partitions   
   are intact or whatever.   
      
   sudo apt install gddrescue        # Need a place to put the data (use a spare   
   disk) ... ddrescue   
      
      man ddrescue                   # Read the instructions, verify the drive   
   names are correct.   
                                     # Overwriting the wrong drive, will ruin it.   
                                     # Generally, a technician only puts the   
   source and dest   
                                     # disks in the machine at this time, for   
   safety.   
      
      sudo ddrescue -f -n     /dev/sde /dev/sdf /root/rescue.log    # Drive to   
   drive rescue (same sized drive)   
                                                                    # First pass   
   gets most of the sectors.   
                                                                    # Copies   
   drive "sde" to drive "sdf".   
      
      sudo xed /root/rescue.log  # Examine transfer record, for extent of damage   
                                 # If, in fact, there were NO crc errors, you can   
   stop here! :-)   
      
      sudo ddrescue -d -f -r3 /dev/sde /dev/sdf /root/rescue.log    # Try to   
   recover the remaining damaged sectors   
                                                                    # Can be run   
   multiple times, but doing this once   
                                                                    # is usually   
   enough.   
      
   The purpose of doing this, is to make sure we haven't lost anything   
   that is potentially recoverable. The data recovered may be   
   total garbage, but that's for a later stage of recovery to decide.   
      
           1TB bad drive  ==>  1TB good drive copy ==> Any size of drive for   
   experiments   
                                                       with the data. Some   
   recovery programs write   
                                                       their recovered data to a   
   *separate* disk which   
                                                       is this disk drive.   
      
   You try not to corrupt the "good drive copy", so it is   
   a reference copy. You would NOT run CHKDSK on the middle   
   drive. You'd copy the middle drive to the right-hand drive   
   and run CHKDSK on the right-hand drive.   
      
   The reason for this care, is the very next time you turn on the   
   power on the drive on the left, it might stop responding and   
   then we can't make any more copies!   
      
      Paul   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)