ddrescue : after having rescued a single partition, can I rescue the whole drive?

Question

It might be a silly question but I had a dying external HDD with one single NTFS partition.

I may have been naive, but I thought it would be better to use ddrescue to rescue the partition and not the whole disk :

sudo ddrescue -v -r 2 /dev/disk3s2 /Volumes/HDD/rescue.img dd.log

It worked quite well :

   current pos:      512 B,  current status: finished
mapfile extent:    1000 GB,  in     23 area(s)

     non-tried:        0 B,  in      0 area(s)  (  0%)
       rescued:    1000 GB,  in     11 area(s)  ( 99.99%)
   non-trimmed:        0 B,  in      0 area(s)  (  0%)
   non-scraped:        0 B,  in      0 area(s)  (  0%)
    bad-sector:    60928 B,  in     12 area(s)  (  0.00%)

Not 100% obviously but 99.99% sounds goods to me!

But now I have a image of a supposed partition. But it is detected as RAW and won't mount.

From what I found on the web, it is better and easier to work on a disk image instead of a partition image. For chkdsk or testdisk.

So I wondered it was possible to rescue the rest of the disk data to the existing image? Or if it would require to re-run the whole ddrescue process from scratch (with the risk that the faulty HDD dies due to the heavy work I asked). Would a command like this would work using the existing image and the existing log?

sudo ddrescue -v -r 2 /dev/disk3 /Volumes/HDD/rescue.img dd.log

Answer 1

It might be a silly question but I had a dying external HDD with one single NTFS partition.

I may have been naive, but I thought it would be better to use ddrescue to rescue the partition and not the whole disk :

sudo ddrescue -v -r 2 /dev/disk3s2 /Volumes/HDD/rescue.img dd.log

The question is not silly, the action is not naive: If you feel like your drive is dying and the primary recovery target is that partition you will reduce stressing the disk by just copying the partition. Otherwise when copying the whole disk your disk may be dead before arriving at the most important location!

Would a command like this would work using the existing image and the existing log?

sudo ddrescue -v -r 2 /dev/disk3 /Volumes/HDD/rescue.img dd.log

No that would fail.

Imagine your disk has just 10 sectors:

1234567890

You recover your partition. Assume it starts at sector 4. That gives you a recovered partition in a file with the content 4567890. When you are recovering the whole disk into the existing file now the file would contain (Each line shows the content of your file after one sector copy operation:

4567890 (before starting the copy operation)

1567890

1267890

1237890

1234890

1234590

1234560

1234567

12345678

123456789

1234567890

Your partition will be overwritten in the beginning and the file will be finally extended. If your disk dies during this process you end up with a file that is only containing a probably useless part of your primary recovery target partition.

Out of 1234567890 you have got 4567890.

Therefore you will have to rescue the beginning of your disk, the first three sectors:

123

Afterwards you would concatenate both parts into a bigger file: "123" & "4567890" gives "1234567890".

=> You need to copy the disc into a different file!

You would need to find out the sector number of /dev/disk3. You would limit your disc copy to the number of sectors that preceed /dev/disk3.

ddrescue provides the parameter -s:

-s bytes --size=bytes Maximum size of the rescue domain in bytes. It refers to a size in the original infile.

Source: https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html

you would end your copy operation including the sector directly preceeding your partition.