Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to recover some deleted files from a healthy NTFS partition on an undamaged hard-disk.

In order to leave the partition undisturbed, i plan to use dd to clone the partition to a raw image file & then attempt recovery from that mounted clone.


Will dd if=/dev/sd<xn> of=/path/to/output.img perform a non-destructive copy ?

Is attempting a restore from a clone using dd the best approach?

[edit, wrt Deltiks answer, i need to be a bit clearer about what i'm asking]
eg: are there some s/w that can do something more with the original sectors ?
eg: if it was a damaged hard-disk i am aware that any kind of read is potentially destructive. but assuming my disk head is not going to suddenly spaz out etc, am i reducing my chances of a successful recovery (at any cost) by using an apparently non-destructive single read of my undamaged hard-disk.

(btw: i am planning on using ntfsundelete & testdisk for recovery)

share|improve this question
    
Good question, but I'm reluctant to answer it because I don't know for sure. My logic works like this: A professional data recovery service would try to read the data without opening the HDD first. If that fails, the data should still be there because only read operations were performed, so the magnetic data shouldn't have been affected. Then, they'd open it up and go through the challenging task of mapping digital addresses to physical locations. And it's expensive. –  Deltik Jun 29 '12 at 18:59
    
a damaged HDD can destroy data on a read. it's mechanical. even NAND degrades on reads (read disturb) ;) ~b/l: any usage wears stuff out! ~am still hoping a h/ware expert turns up & tells me, if for military grade data, a single ordinary read (dd or whatever) is the zen way.. for everyday data, i'm fairly sure that it is. ~ BTW, have now retrieved my data a-ok. i ended up using sleuth kit since it is o/s & i needed to restore file-names & sub-directories. ~worked very well indeed. &&BTW: thx for your input ~one of those +1s is from me lol ;) –  violet313 Jun 29 '12 at 22:43

1 Answer 1

No, the correct command for a non-destructive copy of a partition is:

dd if=/dev/sdxn of=/path/to/output.img

sdx in sdxn should be replaced with the actual device name.

n in sdxn should be replaced with the partition number of the NTFS partition.

This approach is certainly very safe because when you have a copy made, you can easily multiply that image. If you mess up one image, you still have others. If your HDD happens to fail after the copy, well, you still have the copy.

Because the operation is read-only, deleted files that may still be in there won't be touched.

EDIT (2012/06/28 23:00 UTC): Notice the dd if=/dev/sdxn of=/path/to/output.img, which is the directory containing the devices.

EDIT (2012/06/28 23:03 UTC): After your edit, your command is now correct and will perform a non-destructive copy of a partition.


To help further users, or for "just-in-case" scenarios:

If your partition was actually physically damaged...

Use this command instead:

dd if=/dev/sdxn of=/path/to/output.img conv=noerror

The conv=noerror will make dd skip over any areas that it cannot read. Zeros will be written instead. Note that if the partition is physically damaged, reading it may be extremely slow. As I am writing this answer, I'm holding a 20.0 GB Western Digital Caviar manufactured on 02 June 2000. It failed starting around the 18.2 GiB mark, and dd grinded almost to a halt while trying to read past that point.

EDIT (2012/06/28 23:17 UTC): violet313 brought up a good point in a comment. You might as well read a damaged disk to recover data because you'll have to read the data sooner or later. Hard drive recovery by physically tampering with the insides is costly, like this service here.

If dd fails to recover the data you want, consider trying a more aggressive tool to recover your data: ddrescue.

share|improve this answer
    
yes, sry for wasting your time,, when i wrote sdx i actually meant sd<*whatever*> ~since i imagine this question to be of more general use than just solving my specific. –  violet313 Jun 28 '12 at 22:57
    
No, I'm sorry for the confusion. I also meant to point out the /dev/ part right after if=. That directory contains the devices, which you had left off in your question. –  Deltik Jun 28 '12 at 22:59
    
ok,yes good point, i will edit ;) –  violet313 Jun 28 '12 at 23:00
    
cool. so how about the second part of the question ~is cloning the partition using dd & attempting a restore from the clone the best approach? eg: are there some s/w that can do something more with the original sectors ? also before i press ahead, are you absolutely sure about the non-destructive read ? eg if it was a damaged disk any kind of read is potentially destructive.. –  violet313 Jun 28 '12 at 23:13
    
sry, to keep hassling you & labouring the point & so on (it's my fault for not being clear enough in my question ~will now re-edit). but i think your 23:17 edit is dubious; if a disk is damaged, there is a very real possibility that getting it to do anything, even an ordinarily non-destructive read may destroy data. -so if the data is worth paying thro the nose for, it's best to stay well clear of it. –  violet313 Jun 28 '12 at 23:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.