Forensic Image Tool: ddrescue

ddrescue Package Description:

Like dd, dd_rescue does copy data from one file or block device to another. You can specify file positions (called seek and Skip in dd). There are several differences:

• dd_rescue does not provide character conversions.

• The command syntax is different. Call dd_rescue -h.

• dd_rescue does not abort on errors on the input file, unless you specify a maximum error number. Then dd_rescue will abort when this number is reached.

• dd_rescue does not truncate the output file, unless asked to.

• You can tell dd_rescue to start from the end of a file and move backwards.

• It uses two block sizes, a large (soft) block size and a small (hard) block size. In case of errors, the size falls back to the small one and is promoted again after a while without errors.

Tools included in the ddrescue package:

dd_rescue – Copy data from one file or block device to another

root@kali:~# dd_rescue -h

dd_rescue Version 1.28, garloff@suse.de, GNU GPL

($Id: dd_rescue.c,v 1.130 2012/05/19 20:46:14 garloff Exp $)

(compiled Dec 15 2012 12:04:22 by gcc (Debian 4.7.2-4) 4.7.2)

(features: O_DIRECT splice )

dd_rescue copies data from one file (or block device) to another.

USAGE: dd_rescue [options] infile outfile

Options: -s ipos start position in input file (default=0),

-S opos start position in output file (def=ipos),

-b softbs block size for copy operation (def=65536, 1048576 for -d),

-B hardbs fallback block size in case of errs (def=4096, 512 for -d),

-e maxerr exit after maxerr errors (def=0=infinite),

-m maxxfer maximum amount of data to be transfered (def=0=inf),

-y syncfrq frequency of fsync calls on outfile (def=512*softbs),

-l logfile name of a file to log errors and summary to (def=""),

-o bbfile name of a file to log bad blocks numbers (def=""),

-r reverse direction copy (def=forward),

-t truncate output file (def=no),

-d/D use O_DIRECT for input/output (def=no),

-k use efficient in-kernel zerocopy splice

-w abort on Write errors (def=no),

-a spArse file writing (def=no),

-A Always write blocks, zeroed if err (def=no),

-i interactive: ask before overwriting data (def=no),

-f force: skip some sanity checks (def=no),

-p preserve: preserve ownership / perms (def=no),

-q quiet operation,

-v verbose operation,

-V display version and exit,

-h display this help and exit.

Sizes may be given in units b(=512), k(=1024), M(=1024^2) or G(1024^3) bytes

This program is useful to rescue data in case of I/O errors, because

it does not necessarily abort or truncate the output.

ddrescue Usage Example:

Start at position 100 of the input file (-s 100 /var/log/messages) and write, beginning at position 0 of the destination file (-S 0 /tmp/ddrescue-out):

root@kali:~# dd_rescue -s 100 /var/log/messages -S 0 /tmp/ddrescue-out

dd_rescue: (info): Using softbs=65536, hardbs=4096

dd_rescue: (info) expect to copy 1766kB from /var/log/messages

dd_rescue: (info): ipos: 1024.1k, opos: 1024.0k, xferd: 1024.0k

errs: 0, errxfer: 0.0k, succxfer: 1024.0k

+curr.rate: 1122807kB/s, avg.rate: 1018906kB/s, avg.load: 0.0%

>.......................-.................< 57% ETA: 0:00:00

dd_rescue: (info): read /var/log/messages (1767.0k): EOF

dd_rescue: (info): Summary for /var/log/messages -> /tmp/ddrescue-out:

dd_rescue: (info): ipos: 1767.0k, opos: 1767.0k, xferd: 1767.0k

errs: 0, errxfer: 0.0k, succxfer: 1767.0k

+curr.rate: 352945kB/s, avg.rate: 568151kB/s, avg.load: 0.0%

>.......................-................-< 100% ETA: 0:00:00