Quick answer: ddrescue (GNU ddrescue) is a free and open source Linux tool used to image a failing or bad sector disk in a way suitable for data recovery. Its difference from the classic dd command is vital: when a sector cannot be read, ddrescue does not stop; it skips that sector, quickly copies all the easily read areas first, then returns to the hard areas with multiple attempts. This strategy pulls the most data from a dying disk with the least strain. The most critical rule: ddrescue must always run with a map file; this file records where it left off, so the process can pause and resume and unreadable regions can be retried. Never use a failing disk directly, image it first, then work on the image.

Your disk clicks, is unreadable or has lost a partition. The first instinct is to plug it into the computer and try to copy the files. This is the most dangerous mistake in data recovery: a failing disk dies a little more with every read attempt. The correct approach is to image the disk without straining it and do all work on that image. ddrescue was designed for exactly this. This article explains how ddrescue works and how to use it correctly.

Why ddrescue not dd

Both take a disk image but behave completely differently, and that difference decides everything on a failing disk.

dd is simple: it reads from start to end, and if it cannot read a sector it either stops or errors. It is fine on a healthy disk, but on a failing disk it gets stuck on the first bad sector and never recovers the rest of the readable data. It also strains the disk further by insisting on reading a bad region.

ddrescue is smart. Its strategy:

  1. Take the easy data first. It quickly copies all readable areas, does not get stuck on bad sectors, and skips them.
  2. Return to the hard part later. After the easy data is done, it returns to the bad regions it skipped and tries them multiple times from different directions.
  3. Protect the disk. The goal is to recover the most valuable data before the disk dies completely. Insisting on a bad sector for hours can kill the disk; ddrescue manages this intelligently.

In short: ddrescue rescues the vital organs from a dying patient first, then returns to the rest if there is time.

Aspect dd ddrescue
Bad sector Gets stuck or stops Skips, then retries
Read order Straight start to end Easy first, then hard regions
Resume None From where it left off, via map file
Failing disk Strains it, loses data Protects the disk, pulls the most data
Best for A healthy disk A failing, bad sector disk

The map file: the most critical part

The heart of ddrescue is the map file (formerly logfile). This file records which regions of the disk were read, which were skipped and which are bad. Why it is vital:

  • Resumability. If the process is interrupted (power, crash, resting the disk), the map file lets you continue where you left off. You do not start over.
  • Smart retry. ddrescue retries only the unreadable regions. It does not strain the disk re reading already recovered data.
  • Transparency. You see exactly how much was recovered and how much is still bad.

Rule: do not run ddrescue without a map file. A run without a map file forces you to start over if interrupted, which kills an already failing disk.

Basic usage

The typical flow consists of two passes. The target is always a separate, healthy disk, and the failing disk is the source.

# First pass: take the easy data, do not get stuck on bad sectors
ddrescue -n /dev/source_disk /target/image.img /target/recovery.map

# Second pass: retry bad regions multiple times
ddrescue -r3 /dev/source_disk /target/image.img /target/recovery.map
  • -n (no scrape): the first pass skips bad regions without scraping, gathering the easy data quickly.
  • -r3: the second pass retries bad sectors three times.
  • The third argument (map file) must always be provided.

After imaging you never touch the failing disk again. All data recovery, file system repair and file extraction are done on the image. Taking a copy of the image and working on that is even safer.

Rules when working with a failing disk

  • Image first, everything else after. Never mount the failing disk or run a repair tool on it. Every direct access endangers the data. For why this principle is vital, see our article on the danger of running data recovery software on the same disk.
  • Manage heat and time. An overheating or clicking disk is physically failing. ddrescue is a software tool; on a physical failure (head damage, motor) running the disk makes it worse.
  • Choose the right direction. In some cases reading the disk in reverse (-R) recovers more data. ddrescue supports this.
  • Consider write protection. In a forensic context, a hardware write blocker is used to guarantee the source is never written to. For detail, see our article on what a write blocker is.

Where ddrescue falls short

ddrescue is powerful but has limits, and knowing them sets realistic expectations:

  • It does not solve physical failure. A disk with a damaged head, a non spinning motor or a scratched platter requires a cleanroom and special hardware. Running such a disk with ddrescue can make it worse. For the physical process, see our article on what a cleanroom is.
  • It does not solve firmware failure. If the disk's own firmware is corrupt, ddrescue may not see the disk at all. This is a job for professional hardware such as PC-3000.
  • Raw data on an encrypted disk is meaningless. An image is taken but the content is encrypted; the solution requires the key.

In these cases ddrescue alone is not enough; professional lab hardware and expertise are needed.

Common mistakes

  • Running without a map file. If interrupted, everything starts over and the disk is strained.
  • Mounting the failing disk first. Every read attempt endangers the data; image first.
  • Using dd. It gets stuck on the first bad sector and cannot recover readable data.
  • Insisting on a physical failure. A clicking disk is not recovered by software, and running it kills it.
  • Working on the original, not the image. All operations must be done on a copy.
  • The target being smaller than the source. The target disk for the image must be larger than the failing disk.

Frequently asked questions

Is ddrescue free? Yes, GNU ddrescue is open source and free. It is available as a package on most Linux distributions.

Does ddrescue run on Windows? Its native environment is Linux. Booting a Linux live environment (USB) from a working computer and using ddrescue is the common method.

Does ddrescue recover deleted files? ddrescue images, it does not recover files. For deleted files, after imaging you run a recovery tool (such as PhotoRec) on the image.

Should I use ddrescue on a clicking disk? No. Clicking is a sign of physical failure; running the disk can lose data permanently. Such a disk requires a cleanroom.

What happens if I delete the map file? Your progress is lost and the process starts over. Always keep the map file.

Does an image taken with ddrescue count as forensic evidence? If taken with the correct method (write protection, hash verification, logging), yes. In a forensic context the process must be documented and the image hashed.

Sources

If you need to recover data from a failing disk, the first rule is not to strain the disk. For expert support or lab capability, contact DSET. From our Ankara Hacettepe Teknokent laboratory we provide data recovery, forensic imaging and expert reporting.