1

I'm using the foremost,photorec and other tools for recovering data.

What is the best way for cloning the USD or HDD for recovery files?

  • Which one should I use dd or cat or ddrescue?
  • If you recommended to use dd, then how should I use it for carving?
  • Try recovery files of image cloned, is equivalent to try recovery directly to the device?
Milor123
  • 210
  • 1
  • 11
  • 1
    For rescue operations I would recommend `ddrescue`, particularly if you suspect that there are bad sectors (physical damage). See this link and links from it: 'Repair the partition table and file system of a pendrive', https://ubuntuforums.org/showthread.php?t=2196858&p=13409986#post13409986 , browse to the paragraph ' Advanced repair of a partition table, file system and/or recovery of files' – sudodus Jan 26 '17 at 20:28
  • 1
    Carving is the last resort anyway. You should use proper tools for cloning drives (`dd` is the bare minimum, but `ddrescue` or `dcfldd` are definitely better) then start working on data extraction. – Andrea Lazzarotto Jan 27 '17 at 16:35
  • Thank you very much @sudodus and Andrea Lazarotto... and assuming that usb is only media drive, what should I use dd or ddrescue? I want recovery files – Milor123 Jan 27 '17 at 18:49
  • 1
    I suggest again `ddrescue` for this cloning task. And then you can use various tools on the cloned copy in order to recover files, for example *testdisk* to recover the partition structure and file system, and if it fails, *photorec*, that can recover files without any file system. See the link in my first comment and also the following links, https://askubuntu.com/questions/870462/i-unplugged-an-sd-card-without-clicking-eject-and-now-everything-is-read-only/870555#870555 , https://askubuntu.com/questions/862224/how-can-i-get-back-the-data-of-my-usb-on-ubuntu-16-04-1-lts/862227#862227 – sudodus Jan 27 '17 at 19:34
  • And yes, when cloned, all data are the same on the source and target. If you want to play safe, you can clone with *mkusb*, which helps you select the target drive (so that you avoid a disaster). mkusb uses `dd` under the hood, but if you check and double-check, it should work well with `ddrescue`. You can ask here, if the command line you intend to use is good or bad, and wait for a reply before you use it. – sudodus Jan 27 '17 at 19:46
  • Thank very much dude @sudodus should put it like answered – Milor123 Jan 27 '17 at 19:51

1 Answers1

3

Used correctly, dd can copy every byte on a volume. Contrariwise, cat will only copy the contents of files. Obviously, dd is the better choice when data not included in files is of importance.

Zeiss Ikon
  • 5,078
  • 5
  • 18
  • 34
  • Well, `cat` can also write to block devices, like `dd`, and it will be as dangerous, because it does what you tell it to do without questions: `sudo bash -c 'cat mini.iso > /dev/sdx'` where x is the target device. But `dd` can be modified to select 'chunks' in a flexible way, so that I would prefer it to `cat`, but I think `ddrescue` is even better. But remember that all these tools are dangerous - you can easily write to the wrong drive and overwrite valuable data. – sudodus Jan 27 '17 at 08:44
  • And `cat` can read from a block device and write to an image file as described in the following command line: `sudo bash -c '< /dev/sdd cat > testfile.img'` . But I still agree that `dd` is better for the purpose of this question. If you want a safer method you can clone the drive with *mkusb*. It will help you select the target drive in a way that 'wraps security around dd', https://help.ubuntu.com/community/mkusb – sudodus Jan 27 '17 at 09:03