Recovering data from a hard drive which disappears from /dev upon reading data in a bad block

Question

I'm attempting to recover as much data as possible from a failed 750 GB hard drive which is connected via a USB 3 drive enclosure.

The drive itself has over 1500 bad blocks, detected by badblocks on Linux.

It mounts perfectly on my computer (running macOS 10.12), but when data from a corrupt block is read, the drive idles for a few seconds, disappears from /dev, and then reappears — as if someone had unplugged the USB cable and then quickly plugged it back in again.

The first bad block occurs about 136 GiB from the start of the disk, however this is not the only one. This is evidenced by output from badblocks, along with when both dd and ddrescue fail.

dd and ddrescue both fail as soon as they read data from a bad block, since the drive then disappears from /dev:

dd if=/dev/rdisk3 of=image.img bs=16m:

ddrescue -v /dev/disk4 image.img logfile:

Rerunning ddrescue after the initial termination with the same log file results in it immediately terminating and not advancing further.

Since I am able to traverse the filesystem and access some files normally, I wrote a script to determine which files are accessible and which aren't, so I can copy the known good files from the disk. However, this is slow, and I'm worried that it may damage the disk further.

Is there any tool similar to dd or ddrescue which can recover data from this drive, which just waits for the drive to remount instead of automatically quitting upon reading a bad block?

I'm able to use both macOS as well as Linux (Ubuntu), so solutions for either platform would work for me.

Answer 1

when data from a corrupt block is read, the drive idles for a few seconds, unmounts, and then remounts

I had the same problem with a drive that would "disappear" and then reappear later. It wasn't actually mounting either, but ddrescue was stopping when the device was disappearing. I was using it under Linux, but the situation is very similar.

I suggest you use a bit of simple shell programming and the fact that the drive actually eventually shows up again after a while. In other words, do:

while [ 1 ]; do
    ddrescue -v /dev/disk4 image.img logfile
    sleep 3
done

This works as follows:

• ddrescue is started
• if it stops running, the shell waits for 3 seconds then it starts it again
• ddrescue is able to continue because you are making good use of its logging capabilities

After a number of attempts (I think the default is 3 but I may be wrong), ddrescue will mark sectors as definitely bad and it will go on reading other parts of the drive. After some hours you will see that ddrescue will be done and you can kill the loop with Ctrl+C.

Answer 2

From GNU ddrescue Manual:

Example 6: While rescuing a partition in /dev/sda1 to the file hdimage, /dev/sda1 disappears from /dev.

ddrescue -f -n /dev/sda1 hdimage mapfile     <-- /dev/sda1 fails here
  (restart /dev/sda or reboot computer and then repeat the above
   command as many times as needed until it succeeds)
ddrescue -d -f -r3 /dev/sda1 hdimage mapfile

Andrea Lazzarotto's answer covers the "repeat the above command" part. There is an additional step in the example that uses -d switch. The manual explains it a little:

-d
--idirect

Use direct disc access to read from infile, bypassing the kernel cache. (Opens the file with the O_DIRECT flag). Sector size must be correctly set for this to work. Not all systems support this.

It is advised to further read the proper section of the manual. From therein:

Try the --idirect option first. If direct disc access is not available in your system, try raw devices. Read your system documentation to find how to bind a raw device to a regular block device. Some OSs provide raw access through especial device names, like /dev/rdisk.

MacOS does provide /dev/rdisk names. In your question however you use rdisk with dd but disk with ddrescue, so it seems to me you may still benefit from the additional step.

Linux users will find raw command useful. They should refer to man raw and to Example 2: using a raw device in the already mentioned section of the GNU ddrescue Manual.