How to backup corrupted disk before trying to run fix or recovery tool on it

Question

I have two corrupted disks of Ext4 file system, no raid. I believe they are logically corrupted. Before I try any operation to fix them or to recover data from them, I want to make backups into images or new disks, in case I corrupt the disks further using wrong recovery tools.

Questions

1. How can I do this backup in Ubuntu?

2. If I need to recover the images back to disks, can I recover them to any larger disks or I have to recover them to the original disks (in order to run disk fixing tool or data recovery tool)?

Answer 1

1. Use ddrescue. The syntax will be like:

   ddrescue -b 512 -c 65536 /dev/sdy /dev/sdx /path/to/mapfile
   

   Notes:

   • -b 512 should match the physical sector size of the source device. Use -b 4096 if appropriate.

   • In the example above /dev/sdx is the target device. It will be overwritten.

2. An image of an entire disk can be restored to a larger disk. There are at least two possible problems though:

   • GPT (if used) stores its backup copy at the very end of the disk. After being copied to a larger disk, the backup GPT will be in the wrong place. Tools like gdisk should allow you to fix GPT easily.

   • The larger disk may or may not use the same logical sector size as the source disk. If there's a mismatch then the partition table (if any) will not match the data. The problem will be like in this answer (but not because of an USB enclosure; the culprit will be the "wrong" logical sector size of the new disk itself).

     If the logical sector sizes match, there should be no problem. If your source disk does not use a partition table at all (a superfloppy, compare this answer), there should be no problem.

Notes:

• If you suspect the source disk is not physically healthy, a reasonable approach is to use ddrescue to get as much data as you can and then to work with the copy (copies).

• Creating a copy as a regular file (/some/regular/file instead of /dev/sdx in the example) may be a good idea. I prefer this method, there are advantages:

  • You can create a sparse file (ddrescue -S). If the target filesystem supports compression then you can create a compressed file. Anyway it's possible you will need less space for the copy.

  • If the target filesystem supports CoW, a reasonable approach is to leave one copy intact (chattr -i) and create as many CoW-copies from it as you need (cp --reflink=always). Recovery tools that possibly alter anything on the image they work on should be used on such secondary copy (copies).

  If I were you, I would create Btrfs on the new disk(s) and I would copy the old disks to regular files there. Several times I've done something similar.

  OTOH, if a recovery tool refuses to work with a regular file or if it needs separate files for partitions, or if you need a specific sector size, then you may need losetup, kpartx and/or similar tools. Figuring this out is extra effort; for this reason you may prefer copying to a block device. But if you're willing to learn and if you make sure you leave the primary copy intact, there is no risk: you experiment on secondary copies which are expendable anyway.

  In the worst case, if you're totally lost, you can copy the primary copy to a block device and it will be like copying from the source block device to the target block device, i.e. something you originally wanted to do. Note this may require more block devices (disks) because of this intermediate filesystem where you store images as regular files.

  Copying partitions (as opposed to the whole disk) to separate regular files is a possibility: you run ddrescue separately for /dev/sdy1, /dev/sdy2 and so on. Recovering data from such files may be somewhat easier but restoring the original whole disk may be harder.

• Your source disks contain ext4 filesystems, copying them with ddrescue, dd, cp or whatever is safe. If a disk to copy contained Btrfs then you would need to be extra careful because two Btrfs filesystems with identical UUIDs will be seen by the OS as two devices with the same filesystem.