Data Recovery Tutorial - Getting started with DDRescue and TestDisk

We've got an introduction to data recovery with DDRescue and TestDisk. TestDisk is probably where you'll want to start. It will help you recover from non-mechanical problems where some piece of software has trashed your disk, partition tables, MBR or that type of problem. It may even be able to help you "unformat" a wiped hard drive, or wiped USB stick.
DDRescue is a variant of the DD program that's setup specifically for data recovery situations. Unlike DD, DDRescue can produce a physical map of unrecoverable, can retry reads and can automatically resume an interrupted DD.
DD stands for something like disk direct, and is a program that simply moves blocks of data from one device to another. It's also possible to move blocks of data from devices to files and vice-versa.
If you are not used to thinking of devices as files, it can be a little bit of a mind warp to think in these terms. However, it is a simple yet powerful tool that allows for complex recovery scenarios.
**********************************
Thanks for watching our videos! If you want more, check us out online at the following places:
+ Website: level1techs.com/
+ Forums: forum.level1techs.com/
+ Store: store.level1techs.com/
+ Patreon: / level1
+ L1 Twitter: / level1techs
+ L1 Facebook: / level1techs
+ Wendell Twitter: / tekwendell
+ Ryan Twitter: / pgpryan
+ Krista Twitter: / kreestuh
+ Business Inquiries/Brand Integrations: [e-mail]
IMPORTANT Any email lacking “level1techs.com” should be ignored and immediately reported to [e-mail].

[@NetRolller3D]

Contrary to what's suggested here, the "-r" option to ddrescue does not cause it to perform retries in the initial "bulk read" pass, it just specifies how many "retry passes" to run _after_ everything has been tried at least once. So, no need to first run without an -r command, and then re-run with -r10 or something - you can start with -r10, it will still perform the requested 10 retry passes only after the bulk passes are complete.

[@MrLoggfreak]

If you're backing up to an NTFS drive, the --sparse option is really useful on ddrescue This will ensure that bytes of 0's will not take up space. Otherwise, backing up a 1 TB disk will require 1 TB of space on the receiving disk, even if only 100GB of that 1tb disk is used (only works on NTFS, and only works when recovering up to a file, not when cloning to another disk directly)

[@JessePerry]

It's been several years since I needed to run ddrescue... your video was a great refresher. Thanks!

[@JasonRasmussen]

This is great stuff! As a Windows Systems Administrator growing in my Linux knowledge, videos like this are exactally what is needed! Thanks!

[@saturnGEEK]

Jason Rasmussen TestDisk is available for Windows.

[@TheMrFishnDucks]

No idea what is happening but feel smarter after watching this

[@datarecoveryguycom]

Listen up folks! There's some good information on this mans video. Keep up the good work.

[@Snoopod]

Great as always. Didn't even know about these tools

[@poobear2207]

I wish I had watched this video first. Great overview.

[@lassarte1431]

Thanks to testdisk I was able to recover the data from /home and thanks to you for showing it, very good tool to recover data. thank you so much

[@chriskaye1997]

Dude, thanks for your wisdom!

[@AlexRubio]

Been doing this for years! Great to see tek doing gnu/Linux! Not Linux that's just the kernel, but great to see!

[@mikado_]

I love these linux videos especially with Wendell :)

One smartass formated my flash drive. With TestDisk I recovered most of the files. Once I loaned my flash drive to a friend to use, TestDisk recovered even files, which he deleted. Neat and useful utility! It has also a version for Windows.

[@DIVINEWINDSWORD]

thankyou awesome video,... saving this in my favorites incase such a dark day arises.

[@rogerchosnyk1828]

Timing of this video is great. I just lost my 2nd 3tb Seagate st3000dm001. Backblaze reports them at a bit more than 26% failure rate within 3 years, The first was the backup, and this one was the one and only in less than 3 weeks. My bad for proceeding without backup. My system will not even post with it connected, so I will be sending it off to a lab. Which lab is the question now. The information you've provided here it valuable along with the caution flags when using ddrescue. Thank you.

[@QWERTASDFG303]

I want a "Don't poke the badger or you will get a bigger hole in your seater" t-shirt! Wendell you da bomb! I just imaged a failing hard drive and you totally saved my bacon! I always appreciate your content!!

[@Trev488]

Haha funny thing TekSydicate.... My HD died this week! Its un-recoverable but I love these videos. Keep up the good work!

[@deangunsolus6143]

Love the Linux info. I was just able to implement GrayLog at work for our HIPAA clients so I am getting a good bit of exp with Linux. This will be extremely useful of something does go wrong.

[@magarrysilva2568]

Hey! Thanks so much for this video!

[@rars0n]

Testdisk is great for repairing or restoring bad partition information. Particularly useful is the fact that you can view the filesystem of a found partition before actually restoring it. A lot of times Testdisk (especially if you do the deeper scan) will find lots of partitions that you don't want to restore because their contents are corrupt, and this feature will let you see that before restoring it. It seems as though the CHS method that Testdisk reports isn't exactly the best method of representing disk geometry on modern drives and will sometimes generate errors which can be ignored. Booting off a USB versus a live CD is helpful because of the ddrescue log file. Obviously you can't save a log file to a live CD. I'm definitely a novice when it comes to Linux and I'm trying to learn more because I'm running into the limitations of Windows data recovery (you can't access the disk directly like you can in Linux). I guess I have some work to do!

[@tranquanghuy3423]

you are not like the others who puts link filled with adds, so u deserve to be subscribed..... thanks for the plugin and all the best for future

[@abhaysoni9849]

I tried Stellar Data Recovery software and it was really good & helped me at the most crucial moment.

[@Al_Herode]

thanks, it actually let me through so i could download it.

[@callumsmith1516]

thanks dude this really helped

[@cinthyaarnez451]

That was great. Thank you.

[@thomasjackermann]

Well done.

[@matrixate]

I tried a bunch of different programs and R-Studio was the only that actually recovered my huge 40GB video files. I had over 200GB of unrecoverable data and it recovered evey single file. It saved my life. It is really feature rich but it's also simple enough that even if you don't understand how to use all the advanced functions, the default settings are so intuitive and simple that even a monkey could run it. It's totally worth the asking price.

[@kylesebion6903]

I love your videos! However, you mentioned keeping retries low until you get most of the data cloned. Per the manual, retries are done on the last phase. Therefore, there is little chance that the number of retries will splode the heads before all the data from good sectors are recovered. Something I've learned is that retries can result in the clone getting garbage data that is considered good. So, I usually do 0 retries so I have a better idea of what sectors need to be filled in in the clone. Keep the Linux videos coming!

[@user-tu7ee8qj8v]

That is a great point!

[@ArtiomNeganov]

Thanks for the great tutorial! And I'm about to launch `ddrescue` now. Alright, bless my soul!

[@zvtvzvtv4593]

Sweet video

[@illiteratebeef]

This is an awesome video, I hope you continue making lots more. I'm teaching myself linux, I transitioned my home media to a linux based system, now I'm trying to transition that to a normal distro for easier upkeep, and I've been playing with an Odroid c1, arduino Yun, and just got a raspberry pi. I love these videos to help expand what I can do with linux.

[@arias1234]

My sister actually had her drive in her laptop go dead not that long ago and had me recover her data for her, and I had no clue how to do that, but after searching around for a bit online I found testdisk and been using it ever since to recover data on dead drives!

[@attilapinter7141]

+1 on the dd warnings! Last time was copying from img to disk and on of set the wrong disk.... was very lucky was overwriting only my /boot (was on other partition)

[@Tom-ln9fy]

Usefull, thank you

[@CidD]

Its kinda funny when you're saying "I know I'm being paranoid...." and I'm sitting here thinking "YEP UNPLUG EVERYTHING UNNECESSARY, BETTER TO BE EXTREMELY SAFE"

[@MrIzzyreal555]

gr8 video bud! Trying out systemrescue cd to learn about these tools. Liked and subscribed!!!

[@johninforms]

If I had performed a recent backup I wouldn't be watching this video.

[@romeroo29]

Perfect manual how to start grom scratch. thanks

[@santyinmortal]

thanks helpful vid

[@LianSirenia]

Most of this goes right over my head, but I feel a little smarter just from having watched this, haha.

[@-malamute]

This is very confusing but, so far, the best video on the subject I've come across so far. Looking to clone a disk with DDRescue on Windows 10. Do you have any videos that might help to accomplish this?😅

[@ZXRulezzz]

Kinda off the topic of data recovery utilities, but here goes anyway: Once, a friend of my father came to us with his 15-year-old crappy laptop, and he asked us if we could get his data off of it's (full of bad sectors and quickly dying) hard drive. His Windows XP would just BSOD saying there's nowhere to boot from. Dad tried to access it with his own Windows XP machine using USB HDD enclosure. Whole OS would just lockup forever trying to access damaged drive, thus rendering any recovery attempt from Windows impossible. (Windows 7 behaved in the same manner, as it turned out later) And then I hooked it up to my (then) Linux Mint laptop, and it just worked, like nothing was faulty in any way. I was then able to copy drive's contents simply by file, except for a few that were actually damaged (no lockups though, just very lengthy timeouts :)). And Linux actually informed me that FS structure was damaged, but at least it allowed to use it read-only.

[@tamir2424]

Woot S3, represent!

[@danmannz]

You made ddrescue way more complicated than it needs to be

[@mcsc730]

dannzman sure did

[@-malamute]

Do you have a video that makes it easier? Need to clone hard drive on Windows 10 using DDRescue. Any suggestions?

[@danmannz]

@@-malamute you don't need a video, its one command, bootup partimage off the ultimate bcd (there are other linux disdos you could use), ddrescue -f -n -v /dev/hd1 /dev/hd2 logfile.log that will do a straight clone. If there are bad sectors.. the log file will comes in real handy because you can resume it if the drive drop out. You shouldn't be using ddrescue to a SSD.

[@-malamute]

@@danmannz That's very interesting. Why shouldn't DDRescue be used on an SSD? A lot of the people who turn to these videos to try and figure it out aren't schooled in the matter, which is why even though it's just one line of code, it truly helps to watch a video to know what happens/what to do before and after that one line of code is implemented.

[@danmannz]

@@-malamute reading from a damaged SSD is fine, but you should be cloning onto a mechanical drive. DDrescue is a raw cloner, it carbon copies the whole disk.. It will clone unused space on the drive as well. You want to minimize the writes on SSDs because they have a limited amount of writes. Also another protip, sometimes the source drive will drop off and if you use the GUI log analyzer the recovered sectors go blue and it will think you can't recover from those sectors of the drive. If it does this I remove the -n part and use -r for retries. Also sometimes if the source drive keeps dropping off, I've had luck using the -R command to clone in reverse.

[@rectify2003]

Awesome

[@Aint1S]

This is great info for the public. I keep a few systems around for nothing more than recovering Windows partitions with Linux. "Don't poke the badger." Funny... People are going to do it for nothing more than to see what happens. Similar to automatic transmission failure and punching the gas to get it to transfer the power. Lol 💀... 😭!!! 👏👏👏

[@computersrepaircotesaint-l7407]

Thanks

[@DrexxLaggui]

Great tutorial! We need more of this :) Correction please... the correct syntax for mount is "offset=" for the byte offset address. Also, I use mmls instead of parted to check the partitions of the HDD. It's simpler, and no interaction with the user, thus less mistakes.

[@spencerstreeter6535]

So when it comes to revisting the sectors of the hard drive that you didn't get the first time, how do you "resume" and add the recovery attempts to your .raw volume image with no loss of data that you've already recovered?

[@nerdbot4446]

I want a Poke-the-Badger-Shirt

[@xerr0n]

Patrick Star hmm...how to depict a badger as a hard-drive

[@nerdbot4446]

***** I thought on a upright standing, annoyed/angry looking badger in the pose of a ganster rapper carrying a harddrive-necklace that is poked by a grinning Wendell (Cartoon Style).

[@thomaster8870]

Patrick Star and he says "Don't poke the badger!", while poking the badger, Crocodile Hunter-style.

[@blueridgewarden2838]

Patrick Star Would the badger have a Hard drive as a torso?

[@ymer92]

+too school for cool rather a hard drive face

[@blueridgewarden2838]

Question: Why is the black wire on the sata power connector cut at 1:59?

[@beemerboy7951]

I wanna know as well

[@quasarmash]

AH! There is nothing better than watching wendell speak and sipping tea. Wendell, I used testdisk a few years ago to pull out 450GB of movies and it was successful before I send it for replacement....testdisk is pretty good too.

[@user-tu7ee8qj8v]

Do you have a preferred file system that is really robust? I have been attempting to recover my HFS+ drive and this brings many questions about what file systems are better. I see people suggesting that ZFS is a really good and robust file system for reliability. Preferably, it would be nice to have cross compatibility between Windows, Mac, and Linux.

[@jasonl4237]

Is there a windows version for ddrescue and testdisk? Or maybe some alternative similar software for windows? Thanks

[@tjtube263]

So if i accidentally did something like *diskutil partitionDisk /dev/disk2 1 GPT HFS+ newdisk R* to the wrong disk for a fraction of a second, which would be the best tool to use?

[@carverevolition1]

Hi, thanks for that great video! I've booted grml from an usb-stick, loaded os to RAM and removed the stick again. I have got an damaged 2TB hdd with a 1.8TB partition on it. I also pluged in a new 2TB hdd via sata. As the sda has got a partition on it I assmued it is the damaged hdd. So I used: ddrescue -d -r3 /dev/sda1 /dev/sdb ~/ddlog.log --force After one hour it has coppied only 90Mb (0 Errors) Did I do something wrong or is there something I could do to speed that up? (like Chipset drivers) Thank you in advance!

[@gciarami]

Your mount command options gave a syntax error for me.. I had to use this instead: -o loop,offset=10628640 I banged my head against the wall with this, especially considering that I also needed to add another option (sizelimit) equal to the size of the partition. So in your example my call would have been: mount -o loop,offset=10628640,sizelimit=1077511680 Thanks for the very informative video!! PS, I had to install hfsprogs in order to properly parse the Mac hfs+ (hfsplus) drive I was attempting to recover data from.

[@gerardpraetz5460]

I have not used one of my external drives since the day I had the problem with a bad connection on the cord from the wall-wart. I was trying to make it work by holding it and my windows 7 laptop repeatedly made made that sound for connecting and un-connecting the use connection. This was months ago. I am on Social Security and can barely afford food. What can I do?

[@fugeeohu9357]

I was looking for "reinstall" option and started an installation of ubuntu on my drive and when I saw it was formatting the drive I stopped it but the drive is already wiped

[@johannilsson7669]

Can I use Photorec on a ddrescue image? For deleted images on free space?

[@glennmrosek3358]

Can you not just mount the image as an additional drive on a VM, and browse it that way, instead of fiddling with parted & offsets etc?

[@Alphaomg]

This may not help much with the issue of the raid controller. But when you get a HDD that reaches end of life but there might still be some data on it that you need, Try SpinRite a try. It has worked for me a few times. it can take a very long time to just go through 500GB of a drive so a 2TB or more will take much longer. But you will be able to get your data back. Just a thought, I haven't heard you guys talk about this software and thought you guys would like it.

[@amlamarra]

+1 for SpinRite! I've recently discovered this wonderful utility.

[@rars0n]

Spinrite is great, and I use it quite a bit with often amazing results, but for drives over 500GB it will usually stop mid-process with a fatal error. Spinrite has massive problems handling drives larger than 500GB. That said I'll still use it on larger drives to at least get a sense of the health of the earlier portion of the drive. It's also completely useless on EFI partitions. It just plain won't work. For whatever reason, this exception doesn't apply to MacOS partitions. For EFI partitions that Spinrite can't work on, I'll use HDD Regenerator, but that program isn't nearly as thorough as Spinrite. Spinrite also works best in IDE mode, not AHCI. Spinrite 7 is supposed to address a lot of these shortcomings, but it's been in the works for at least a decade now so I'm not holding my breath.

[@Nightowl_IT]

Hi Please put a link in the discription below the video to the video that covers the scenario when you overwrite the first 100-300MiB of a partition. Thanks if you do because I ran into that problem. :( Jan

[@technodude5252]

lol I just finished recovering my drive that broke would have been useful a week ago. But now i know a better way to recover my data, Thanks anyway Wendel!

[@kdr-ql7pz]

Do understand has a command linke example ( & suggested utility) to recover multiple deleted files ( same name) from different hardrives? Akso, the process by step order. Thanks

[@neilbedwell7763]

I've stupidly gotten syself into the exact scenario that Wendell damns at 5:01 . I accidentally 'dd if=/dev/zero of=/dev/sdb bs=4k && sync' where sdb... contained my life lol its a 2tb. i killed the process after noticing my error and assume most of the files are still on there. I have tired running photorec but the ETA completion time goes up and up and up. once it reached 600hrs i cancelled it. It had found a hundred odd files in that time though. Is there a way to fix my issue with testdisk, so that i won't go insane sorting through thousands of files to find the right ones (photorec can't recover dir structure or file name)? failing that, is there a way to get photorec to finish the job before i retire?

[@GradyHouger]

Neil Bedwell as you may have found in the month since you asked this, yes, there are other file rescue options. I've been away from data recovery to long, can't remember the process, but it's out there to find.

[@troyBORG]

That low bitrate when showing what "dd" was.. If I saw that I would of just re-recorded that portion when you was editing

[@indicator27]

what should i do with a RAW, cant assign letter to that in diskpart. it was a ntfs i dropped, testdisked, and cloned to another drive. have two RAWs now, linux can see them, and i do remember it being fixable by chkdsk but i cant do that to a raw, should i gui chkdsk in win10? i dont want to mess it up, i have 1 million mp3s. testdisk = fixboot?

[@extremebanana1850]

Cinnamon master race!

[@Tome4kkkk]

Is there a ddrescue-gui for Windows? It's advertised but not in Downloads.

[@zeuscarver3112]

at 15:05 & 16:14 he typed 10628640 but what parted reported is 106928640. Missed the 9. I wonder if the mount command worked? It probably mounted half of the first partition instead of the second partition.

[@ordersakamoto6549]

This is a bit off topic, but my laptop doesn't want to work with distro that isn't based on a gnome distribution. pls help,

[@MsHUGSaLOT]

ddrescue be used to create backups as image files?

[@outfl1595]

HUGSaLOT Valkyrie I think it can, but why? just use "dd if=path/to/source of=path/to/destination bs=64M", or "pv -tpreb path/to/source | dd of=path/to/destination bs=64M" to also see the progress (pv is a separate utility, but i think it should be in every popular distribution's repos)

[@Ellipsis115]

8:15 It should never enter into any of the commands, thank you great observation to pass on! 9:19 9:37 Cheers

[@testkanal2mille]

Testdisk worked like a charm when i lost the partion table to my windows system disk, due to some black voodoo magic i tried with that partition. Exept it recovered an about 5 year old state of the disk, but eh, in theory it worked.

[@ericbrinsfield7664]

I use Btrfs with snapshots and stuff for backups. I have been using it for 2 years now. I have been using Ubuntu for almost 6 years or is it 6 years now. It has been long enough that I get lost on a Windows machine.

[@fugeeohu9357]

I tried that all I got was "boot lost+found swapfile" after mount raw image and ls command on the mount point

[@user-super-user]

i dont use a nas, i backup to some 3.5" drives in a hotswap bay on the front of my pc. (i alternate the backup between the hdd's) i agree with windal ive wiped a pc with dban by mistake XD glad i make religious full disk image backups

[@rGGdom]

Is there a way to pause DDRescue? How to stop then resume? I need to know since I live in a country where blackouts are common.

[@imarkovic1]

Hi, could you please share what is the best software for recovering the files which has wiped out from hard drive using DD to zero..? Or there is no way to recover it by software..? I have managed to recover all the disks whch had NTFS, but what I was unable to recover are the disks with EXT3/JFS filesystems... TestDisk was useless here.

[@od077]

good one thx's Wendall ;)

[@junaidkhan5652]

i dont have "packs" folder at the right side x) help

[@supremedictator.]

I see "testdisk" in the title, but where in the video are the testdisk instructions?

[@swefress]

Are there alternatives for this for Windows 7 or 10?

[@user-mn3vh4ku9y]

Man, is there anything Seth Rogen cant do?!?! Thanks man!

[@tezaswiraj4244]

I accidentally format my hard drive using 'dd' command Is there any way to recover my files on my hard disk?

[@YARDMANMX]

My disk does not show up on my mac what can i do

[@MyRandomNick]

What are the scenarios in which you don't want/need to use a log file?

[@mar2ck_]

The man page says to always use one

[@eiriklade93]

#TekLinux Good video! Could you perhaps also do a video covering general network folder sharing and the TEK related to it? I understand it's somewhat complicated between systems running Microsoft based services, and systems running Linux based. PS: I'm aware of third party applications dealing with this. But I want to dig deeper!

[@danielvandonsel6173]

***** Samba is pretty easy to set up

[@PaulSmith-hr5rn]

***** as below, install the samba protocal in windows, and thats pretty much it, just make sure you have a user account that can access the folder your sharing. thats about the size of it. to get into more detail, ie security wise, thats more a thing for how your distro handles accounts, and how your firewall is setup.

[@sohailmeer6087]

i was using opensuse 12.1 with xen hypervisor my virtual machine get deleted can you tell me how can i recover it

[@RMSTECHLLCVineland]

Google.com

[@tizzschnitzel2711]

Can you please more videos about recovery

[@shirayukix2155]

9:29 oh i'm fully aware of the paranoia especially after my ssd shat on me out of left field. I'm gonna be having like 6 backups of just the backup to avoid this ever happening again.

[@bazimtsweni5343]

Where can I inbox or email you for more information on a similar but difficult problem?

[@friedzombie4]

I thought it was my work network; but holy crap try watching this on a 4k monitor fullscreen if you want to cry yourself to sleep tonight.

[@logikgr]

Remember kids: The bigger your monitor's resolution, the bigger your penis is.

[@ChristopherNewman63]

what if the head is stuck on the platter? i know that this is what is happening as I have I have a distinct beeping noise. anything I can do at this point or is it done for?

[@GoodOlKuro]

Christopher Newman bump it gently

[@ChristopherNewman63]

with my hand or knock it against a desk? also the two surfaces are extremely smooth causing insane amounts of friction meaning it stuck better than glue.. but I will try

[@GoodOlKuro]

***** good idea. that reminds me of this video from DIYperks /watch?v=F5Y7BniaRXg. he also has a video where he bulilds a dust filtered work box.

[@miljororforsprakpartiet290]

you don't specify target disk, so where will files end up? :S

[@VincentVonDudler]

Tutorial looks like it starts at 8:40

[@edstar83]

Instructions unclear clear, accidentally formated the internet.

[@NetRolller3D]

Dd doesn't stand for "disk direct" - it pretty much stands for "dopy and donvert". It's an old Unix in-joke - it was originally written as "cc" ("copy and convert"), but that name was already assigned to the C compiler, so the name was incremented by one letter.

[@ratanythay3312]

Hi sir, could you show more detail about using Testdisk in data recovery?