Understanding Data Recovery with Dd and Ddrescue on Linux

Losing data is one of the most stressful experiences in IT. Whether it's a failing hard drive, an accidentally wiped partition, or a corrupted filesystem, knowing how to respond quickly and correctly can mean the difference between full recovery and permanent loss. Two tools that every Linux administrator should know are dd and ddrescue. This post breaks down what they do, how they differ, and when to use each one.

What Is dd and Why Does It Matter for Data Recovery?

The dd command is a low-level disk copying utility that has been part of Unix and Linux systems for decades. It reads and writes data block by block, bypassing the filesystem entirely. This makes it extremely powerful for cloning drives, creating disk images, and performing basic data recovery on Linux.

The basic syntax looks like this:

dd if=/dev/sda of=/mnt/backup/sda_image.img bs=4M status=progress

Let's break down those options:

• if= specifies the input file (or device, like /dev/sda)
• of= specifies the output file or destination
• bs=4M sets the block size to 4 megabytes for faster throughput
• status=progress shows live progress output (available in newer versions)

The result is a byte-for-byte image of the source drive, which you can later mount, analyze, or restore from.

The Problem with dd on a Failing Drive

Here's the catch: dd is not designed to handle read errors gracefully. If it hits a bad sector, it will either stop completely or skip data in unpredictable ways. On a healthy drive, this is fine. On a failing or damaged drive, it can actually make the situation worse by stressing the hardware further.

This is exactly where ddrescue comes in.

Introducing ddrescue: Recovery-First Design

GNU ddrescue is purpose-built for recovering data from damaged media. Unlike dd, it is intelligent about errors. It reads all the good data first, then goes back and retries the bad sectors. It also uses a log file (called a map file) to track its progress, so if the process is interrupted, you can pick up exactly where you left off.

To install it on a Debian or Ubuntu-based system:

sudo apt install gddrescue

A basic ddrescue recovery command looks like this:

sudo ddrescue -d -r3 /dev/sda /mnt/recovery/sda_image.img /mnt/recovery/sda.log

Breaking that down:

• -d uses direct disk access, bypassing the kernel cache
• -r3 retries bad sectors up to 3 times before giving up
• The third argument is the map file, which logs which sectors have been recovered

If you need to pause the recovery and resume later, simply run the exact same command again. ddrescue will read the map file and continue from where it stopped. This is a huge advantage when working with drives that take hours to image.

dd vs ddrescue: Choosing the Right Tool

Knowing which tool to reach for depends on the state of the drive you are working with.

• Use dd when the source drive is healthy and you just need a fast, reliable clone or image.
• Use ddrescue when the drive shows signs of failure, produces read errors, or is physically unstable.

A common real-world workflow is to use ddrescue to recover as much data as possible from a failing drive into an image file, then mount that image on a healthy system to extract the files you need.

You can mount a recovered image like this:

sudo mount -o loop,ro /mnt/recovery/sda_image.img /mnt/recovered

The -o ro flag mounts the image as read-only, which is good practice during forensic or recovery work. You want to avoid writing to your only copy of the data.

A Word of Caution

Both tools require careful attention to the if= and of= arguments. Swapping them can overwrite the drive you are trying to recover. Always double-check your device names using lsblk or fdisk -l before running either command. Working on an image file rather than directly on the original device is always the safer approach.

What's Next

Now that you understand how to image and recover disk data, the next logical step is understanding how to verify the integrity of those backups. In the next post, we'll look at using checksums and hashing tools like md5sum and sha256sum to confirm that your backups are complete and uncorrupted. That's a skill that pairs directly with everything covered here.

For deeper study on backup and restore operations as they relate to the Linux+ exam, the CompTIA Linux+ Study Guide by Richard Blum covers this domain in practical detail and is well worth having on your desk.

Tools and resources for this topic

• CompTIA Linux+ Study Guide: Comprehensive Linux+ exam preparation covering system administration, security, and scripting.