Wednesday, April 27, 2011

Recover Data From a dead hard drive using dd

The ‘ dd ‘ command is one of the original Unix utilities and should be in everyone’s tool box. It can strip headers, extract parts of binary files and write into the middle of floppy disks; it is used by the Linux kernel Makefiles to make boot images. It can be used to copy and convert magnetic tape formats, convert between ASCII and EBCDIC, swap bytes, and force to upper and lowercase.
For blocked I/O, the dd command has no competition in the standard tool set. One could write a custom utility to do specific I/O or formatting but, as dd is already available almost everywhere, it makes sense to use it.
Hard drive failures can occur for many reasons one of the most common thing every user can observer is if your hard disk is having some problems it does make some clicking noise this is one hint i would suggest every user can follow.
If you don’t hear any clicking noise it might be some electonics failure in such cases you can use hdparm to turn off some advanced drive features that will get around the part of the electronic component that has failed.Most important setting is turnning off DMA access.If you want more details about hdparm check this article.
Like most well-behaved commands, dd reads from its standard input and writes to its standard output, unless a command line specification has been given. This allows dd to be used in pipes, and remotely with the rsh remote shell command.
Unlike most commands, dd uses a keyword=value format for its parameters. This was reputedly modeled after IBM System/360 JCL, which had an elaborate DD ‘Dataset Definition’ specification for I/O devices. A complete listing of all keywords is available from GNU dd with.
dd Syntax
or: dd OPTION
# dd --help
This will provide all the available options for dd
For more options check dd man page here
Using dd you can create backups of an entire harddisk or just a parts of it. This is also usefull to quickly copy installations to similar machines. It will only work on disks that are exactly the same in disk geometry, meaning they have to the same model from the same brand.
Creating a hard drive backup directly to another hard drive
dd bs=4k if=/dev/hdx of=/dev/hdy conv=noerror,sync or dd bs=4k if=/dev/hdx of=/path/to/image conv=noerror,sync
Now we i will explain above example one by one
Specifies the input path. Standard input is the default.
Specifies the output path. Standard output is the default. If the seek=expr conversion is not also specified, the output file will be truncated before the copy begins, unless conv=notrunc is specified. If seek=expr is specified, but conv=notrunc is not, the effect of the copy will be to preserve the blocks in the output file over which dd seeks, but no other portion of the output file will be preserved. (If the size of the seek plus the size of the input file is less than the previous size of the output file, the output file is shortened by the copy.)
Sets both input and output block sizes to n bytes, superseding ibs= and obs=. If no conversion other than sync, noerror, and notrunc is specified, each input block is copied to the output as a single block without aggregating short blocks.
conv=value[,value. . . ]
Where values are comma-separated symbols
Does not stop processing on an input error. When an input error occurs, a diagnostic message is written on standard error, followed by the current input and output block counts in the same format as used at completion. If the sync conversion is specified, the missing input is replaced with null bytes and processed normally. Otherwise, the input block will be omitted from the output.
Pads every input block to the size of the ibs= buffer, appending null bytes. (If either block or unblock is also specified, appends SPACE characters, rather than null bytes.)
Compression Backup
dd if=/dev/hdx | gzip > /path/to/image.gz
Hdx could be hda, hdb etc. In the second example gzip is used to compress the image if it is really just a backup.
Restore Backup of hard disk copy
dd if=/path/to/image of=/dev/hdx
gzip -dc /path/to/image.gz | dd of=/dev/hdx
MBR backup
In order to backup only the first few bytes containing the MBR and the partition table you can use dd as well.
dd if=/dev/hdx of=/path/to/image count=1 bs=512
MBR restore
dd if=/path/to/image of=/dev/hdx
Add “count=1 bs=446″ to exclude the partition table from being written to disk. You can manually restore the table.
More Examples
dd bs=4k if=/dev/sda1 of=/dev/sda2/backup.img conv=noerror,sync
This command is used often to create a backup of a drive (/dev/sda1) directly to another hard drive (/dev/sda2). The option “bs=4k” is used to specify the block size used in the copy. The default for the dd command is 512 bytes: use of this small block size can result in significantly slower copying. However, the tradeoff with larger block sizes is that when an error is encountered, the remainder of the block is filled with zero-bytes. So if you increase your block size when copying a failing device, you’ll lose more data but also spend less time trying to read broken sectors.
If you’re limited on local space you can use a pipe to gzip instead of the “of=” option.
dd bs=1024 if=/dev/sda1 conv=noerror,sync | gzip -9 > /dev/sda2/backup.dmg.gz
Here dd is making an image of the first harddrive, and piping it through the gzip compression program. The compressed image is then placed in a file on a seperate drive.

No comments:

Post a Comment