[SOLVED] Why is ddrescue running so slow

ronells2000 · 10-10-2016, 12:21 PM

My hard drive is unable to boot. ddrescue has been running so long the only thing I can remember is that chdsk was stuck at 11%. I did a lot of research on the internet and it always came back to running a Linux base OS. I know very little about Linux but found that ddrescue was probably my best option to recover my data. I really don't understand the proper use so I trusted the recomendations in the forums. A few of the post's recomended the -R options so that is what I tried.

ddrescue -R /dev/sda5 /media/sdb1/Backup_image/091616.img /media/sdb1/091616.log

I am trying to rescover it has been running for 3 weeks now, but I do not now if this is normal. I have thought about stoping it and starting a new option but I don't know which one, or 2 or 3. The drive I'm running ddrescue on is a 1TB HDD. The drive copied to is a 3TB, USB external drive. Below is the current progress:

GNU ddrescue 1.20
Press Ctrl-C to interrupt
rescued: 542206 MB, errsize: 0 B, current rate: 131 kB/s
ipos: 429434 MB, errors: 0, average rate: 271 kB/s
opos: 429434 MB, run time: 23d 2h 57m, remaining time: 42d 22h 17m
time since last successful read: 0 s
Copying non-tried blocks... Pass 1 (backwards)

I have been busy with other things, so I just let it run. Well I am back on it and I searched some more and a couple of sites referenced "The best method: Antonio Diaz's GNU 'ddrescue'".

# first, grab most of the error-free areas in a hurry:
./ddrescue -n /dev/old_disk /dev/new_disk rescued.log
# then try to recover as much of the dicy areas as possible:
./ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log

If 3 weeks is normal and the option I'm running is normal I will let it run, but this is ridiculous. I need some help.

Well, I tried to unmount a USB thumb drive and I rebooted the system. Stupid!

Should I continue the process I started or is there a better and faster way?

allend · 10-10-2016, 05:45 PM

Welcome to LQ!

Quote:

If 3 weeks is normal and the option I'm running is normal I will let it run, but this is ridiculous. I need some help.

No, this is not normal. If things are all OK, then ddrescue will run in a time comparable to a normal copy.

Quote:

rescued: 542206 MB, errsize: 0 B, current rate: 131 kB/s

This shows that half the disk has been recovered, without errors and that the data transfer rate has dropped to a crawl.

You are fighting with failed hardware. If you really need to try and recover the remainder of the disk, then seek professional help. It may be possible to swap the PC board on your failed drive for a working unit, and recover.

I feel your pain. I had a drive do this on me earlier this year. The first half of the drive was recovered without error. The last half of the drive was unrecoverable, requiring a tedious recall from backups.

ronells2000 · 10-10-2016, 09:30 PM

Thank you allend, I figured this was not normal but was afraid to lose all the data it had already recovered. I connected the back-up USB hard drive to my wife’s laptop and the backup folder is empty and there is no backup log. Is this because Windows cannot see Linux data? I was hoping to at least see if I could recover some of the data. I had backup software running every Saturday night, but I had some data in between that I was hoping to recover, didn't need the whole partition. I have a new hard drive coming so it looks like I'll be spending some time with the whole reinstallation process.

syg00 · 10-10-2016, 10:41 PM

Probably - fire up a liveCD and have another look.
The value of your data should determine the backup frequency, not the day of week. Are the changes you make on Saturday more valuable than any other day ?.
As to your initial question, forcing all the read to be in reverse would appear the absolute last option you should consider. I imagine the driver would not be able to consolidate reads - every sector would have to be a separate read. Awful.
Have a look at the ddrescue manual with a tutorial written by the authors of the tool - here

FWIW I don't even bother to try and recover faulty disks - once they start playing up I toss them out.

ronells2000 · 10-13-2016, 04:21 PM

syg00, I'm running Acronis True Image 2017. I had data recovery running every night, but it was filling up the HD to fast, so I set it to run every Saturday night instead. Saturday night, because I figured no night is better than the others.

I'm using the CAINE Live-CD v7.0. I have tried another route. I used the Antonio Diaz's GNU 'ddrescue' suggested in other threads:

# first, grab most of the error-free areas in a hurry:
./ddrescue -n /dev/old_disk /dev/new_disk rescued.log
# then try to recover as much of the dicy areas as possible:
./ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log

Here's the screen with the -n option:

#ddrescue -n /dev/sda5 /media/sdb1/Backup_image/091616.img /media/sdb1/Backup_image/091616.log
GNU ddrescue 1.20
Press Ctrl-C to interrupt
rescued: 971641 MB, errsize: 5120 B, current rate: 12288 kB/s
ipos: 809339 MB, errors: 0, average rate: 45542 kB/s
opos: 809339 MB, run time: 5h 55m 35s, remaining time: 12s
time since last successful read: 0 s
Finished
root@caine:/home/caine#

Here's the screen with the -r 1 option:

#ddrescue -r 1 /dev/sda5 /media/sdb1/Backup_image/091616.img /media/sdb1/Backup_image/091616.log
GNU ddrescue 1.20
Press Ctrl-C to interrupt
Initial status (read from mapfile)
rescued: 971641 MB, errsize: 5120 B, errors: 10

current status
rescued: 971641 MB, errsize: 155 B, current rate: 0 kB/s
ipos: 809339 MB, errors: 5, average rate: 0 kB/s
opos: 809339 MB, run time: 35m 38s, remaining time: n/n
time since last successful read: 37m 38s
Finished
root@caine:/home/caine#

This is how I mounted the image:

#mount /media/sdb1/Backup_image/091616.img /mnt -o loop

when I look in the mnt folder all I see is:
boot (folder)
efi (folder)
sources (folder)
support (folder)
autorun.inf
bootmgr
bootmgr.efi
MediaMeta.xml
setup.exe

what happened to the 971641MB of data? Am I mounting it correctly? Will PhotoRec see the actual data?

syg00 · 10-13-2016, 09:07 PM

That looks like an (Win10 ?) EFI partition. I wouldn't expect it to be too big. What does this return

Code:

parted /dev/sda "print free"

photorec should be able to scrape files from the image if there are any there - but it will be slow. And you'll need another output device - should fit on that one, but will slow down the whole operation even further.

ronells2000 · 10-14-2016, 02:01 PM

I am still trying to figure out how to run PhotRec on a mounted .img file to the /mnt folder. When I ran lsblk -o name,label,size,fstype it did show loopX mounted as a 904,9G drive (unfortunately I lost the information during the umount). When I run PhotoRec with no options it only shows the physical drives.

But for some reason I wanted to remove the USB drives (don't remember why). I had the destination USB drive mounted, media/sdb1, and /media/sdc1 where I was going to copy the recovered data to. When I performed an umount /media/sdb1 (and sdc1) on the USB drives it gave me all indications that they unmounted. I had lost all my data on a USB thumbdrive earlier when I unmounted it so I wanted to make sure the data was still on the USB Drives sdb1 and sdc1. When I tried to mount them they came up with an error: "Mount is denied because the NTFS volume is already exclusively opened. The volume may be already mounted, or another software may use it which could be identified for example by the help of the ‘fuser’ command."

When I ran the "mount" command it returned (at the bottom of the results):
/dev/loop1 on /media/sdb1 type fuseblk (rw,.........)
/dev/loop2 on /media/sdc1 type fuseblk (rw,.........)

I tried to umount the loop's but they came back as not mounted ??

I ran fuser -m /dev/loop1 and got a bunch of numbers, like 1c 10c etc............, but I did not see any processes.

so I performed fuser -v -k -l /dev/loop1 (and loop2), then:
umount /dev/loop1 (and loop2), it returned no errors

so I decided to mount the drives again to check the data, the data I had written on the drives, plus the .img and .log files were gone.

I am running ddrescue again, how can I keep this from happening again? Is it auto mounting the loop's or just not unmounting them when I unmount the drives?

ronells2000 · 10-14-2016, 07:51 PM

I finished another run of ddrescue,
syg00 here's the output you asked for, hope it's still relevant since it's not when you asked originally:

Code:

root@caine:/home/caine# parted /dev/sda "print free"
Model  ATA  HTS541010A9 (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical) 512B/4096B
Partition Table: gpt

Number  Start    End      Size     File system  Name                  Flags
        17,4kB   1049kB   1031kB   Free Space
1       1049kB   1051MB	  1049MB   ntfs                                 hidden, diag
2       1050MB   1322MB   273MB    fat32        EFI system partition    boot
3       1322MB   1847MB   524MB    fat32                                hidden
4       1847MB   1981MB   134MB                 Microsoft reserved partition   msftres
5       1981MB   974GB    972GB    ntfs         Basic data partition    msftdata
6       974GB    974GB    367MB    ntfs                                 hidden, diag
7       974GB    1000GB   26,2GB   ntfs                                 hidden, diag
	1000GB   1000GB   729kB    Free Space
root@caine:/home/caine#

I also ran lsblk:

Code:

root@caine:/home/caine# lsblk -o name,label,size,fstype,model
NAME    LABEL         SIZE     FSTYPE   MODEL
sda                   931,5G            HGST HTS541010A9
Ͱ-sda1  WINRE_DRV      1000M   ntfs
Ͱ-sda2  SYSTEN_DRV      260M   vfat
Ͱ-sda3  LSR_ESP         500M   vfat
Ͱ-sda4                  128M
Ͱ-sda5  Windows8_OS   904,9G   ntfs
Ͱ-sda6                  350M   ntfs
Ͱ-sda7  PBR_DRV        24,4G   ntfs
sdb                     2,7T            My Passport 295F
└sdb1   My Passport     2,7T   ntfs
sdc                     1,8T            My Passport 295D
└sdc1   My Passport     1,8T   ntfs
sr0     sblive            3G   iso9660  BDDVDRW CA40N
loop0                     2G   squashfs
loop1   My Passport     1,8T   ntfs
loop2   My Passport     2,7T   ntfs
root@caine:/home/caine#

the USB drives are showing as loop1 and loop2 again. Is this normal? How do I unmount the sdb1 & sdc1 hard drives and the loops's without loosing my data again?

Edited: Used Code Tags as suggested. Thank you syg00

syg00 · 10-14-2016, 10:55 PM

Use [code] tags ...

Code:

root@caine:/home/caine# parted /dev/sda "print free"
Model  ATA  HTS541010A9 (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical) 512B/4096B
Partition Table: gpt

Number  Start    End      Size     File system  Name                  Flags
        17,4kB   1049kB   1031kB   Free Space
1       1049kB   1051MB	  1049MB   ntfs                                 hidden, diag
2       1050MB   1322MB   273MB    fat32        EFI system partition    boot
3       1322MB   1847MB   524MB    fat32                                hidden
4       1847MB   1981MB   134MB                 Microsoft reserved partition   msftres
5       1981MB   974GB    972GB    ntfs         Basic data partition    msftdata
6       974GB    974GB    367MB    ntfs                                 hidden, diag
7       974GB    1000GB   26,2GB   ntfs                                 hidden, diag
	1000GB   1000GB   729kB    Free Space

NAME    LABEL         SIZE     FSTYPE   MODEL
sda                   931,5G            HGST HTS541010A9
Ͱ-sda1  WINRE_DRV      1000M   ntfs
Ͱ-sda2  SYSTEN_DRV      260M   vfat
Ͱ-sda3  LSR_ESP         500M   vfat
Ͱ-sda4                  128M
Ͱ-sda5  Windows8_OS   904,9G   ntfs
Ͱ-sda6                  350M   ntfs
Ͱ-sda7  PBR_DRV        24,4G   ntfs
sdb                     2,7T            My Passport 295F
└sdb1   My Passport     2,7T   ntfs
sdc                     1,8T            My Passport 295D
└sdc1   My Passport     1,8T   ntfs
sr0     sblive            3G   iso9660  BDDVDRW CA40N
loop0                     2G   squashfs
loop1   My Passport     1,8T   ntfs
loop2   My Passport     2,7T   ntfs

syg00 · 10-14-2016, 11:13 PM

Unmount the image and run this

Code:

partx --show yourfile.img

ronells2000 · 10-17-2016, 11:47 AM

Sorry so late of a response, I've been working on unmounting and mounting my drives "without" loosing the data/image files. I wanted to copy the return info to a doc instead of having to type it in every time, but every time I would unmount either my USB drive or thumb drive I would loose the data. I think I figured it out, I've been running

Code:

umount -d /media/sdc1

it will also unmount any loop device attached to it.

Back to your last request, unmount the image and run partx:

Code:

root@caine:/media/sdb1/Backup_image# partx --show image_101616.img
partx: image_101616.img: failed to read partition table

Back when I mounted the image into the /mnt folder all I seen was:

Code:

 boot (folder)
 efi (folder)
 sources (folder)
 support (folder)
 autorun.inf
 bootmgr
 bootmgr.efi
 MediaMeta.xml
 setup.exe

Aren't the EFI and BOOT folder's supposed to be in partition 1 or 2 (sda1 or sda2)?

ronells2000 · 10-17-2016, 02:00 PM

I found kpartx while searching for mounting disk images. Below is an example from the man page:
To mount all the partitions in a raw disk image:

Code:

      kpartx -av disk.img

This will output lines such as:

    loop3p1 : 0 20964762 /dev/loop3 63

The loop3p1 is the name of a device file under  /dev/mapper  which you
can use to access the partition, for example to fsck it:

    fsck /dev/mapper/loop3p1

output of mounting with kpartx:

Code:

root@caine:/media/sdb1/Backup_image# kpartx -av /media/sdb1/Backup_image/image_101416.img
Alternate GPT is invalid, using primary GPT.
add map loop3p1 (252:0): 0 2048000 linear /dev/loop3 2048
add map loop3p2 (252:1): 0 532480 linear /dev/loop3 2050048
add map loop3p3 (252:2): 0 1024000 linear /dev/loop3 2582528
add map loop3p4 (252:3): 0 262144 linear /dev/loop3 3606528
device-mapper: resume ioctl on loop3p5 failed: Invalid argument
create/reload failed on loop3p5
add map loop3p5 (0:0): 0 1897738240 linear /dev/loop3 3868672
device-mapper: resume ioctl on loop3p6 failed: Invalid argument
create/reload failed on loop3p6
add map loop3p6 (0:0): 0 716800 linear /dev/loop3 1901606912
device-mapper: resume ioctl on loop3p7 failed: Invalid argument
create/reload failed on loop3p7
add map loop3p7 (0:0): 0 51200000 linear /dev/loop3 1902323712
root@caine:/media/sdb1/Backup_image#

I check to see if loops mounted:

Code:

root@caine:/dev/mapper# dir
control  loop3p1  loop3p2  loop3p3  loop3p4
root@caine:/dev/mapper# dir loop3p1
loop3p1
root@caine:/dev/mapper# cd loop3p1
bash: cd: loop3p1: Not a directory
root@caine:/dev/mapper#

same error for loop3p2, p3 & p4.

next I ran fsck on the 4 loops that mounted:

Code:

fsck loop3p1
fsck from util-linux 2.20.1

Code:

fsck /dev/mapper/loop3p2
fsck from util-linux 2.20.1
fsck.fat 3.0.26 (2014-03-07)
0x41: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt.
1) Remove dirty bit
2) No action
? 1
Free cluster summary wrong (58195 vs. really 58187)
1) Correct
2) Don't correct
? 1
Leaving filesystem unchanged.
/dev/mapper/loop3p2: 177 files, 7349/65536 clusters

Code:

# fsck /dev/mapper/loop3p3
fsck from util-linux 2.20.1
fsck.fat 3.0.26 (2014-03-07)
Both FATs appear to be corrupt. Giving up.

Code:

fsck /dev/mapper/loop3p4
fsck from util-linux 2.20.1
e2fsck 1.42.9 (4-Feb-2014)
ext2fs_open2: Bad magic number in super-block
fsck.ext2: Superblock invalid, trying backup blocks...
fsck.ext2: Bad magic number in super-block while trying to open /dev/mapper/loop3p4

The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem.  If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>
 or
    e2fsck -b 32768 <device>

When I run lsblkit it returns (I skipped the USB drives sdb1 and sdc1):

Code:

NAME             LABEL         SIZE FSTYPE   MODEL
sda                          931,5G          HGST HTS541010A9
├─sda1           WINRE_DRV    1000M ntfs     
├─sda2           SYSTEM_DRV    260M vfat     
├─sda3           LRS_ESP       500M vfat     
├─sda4                         128M          
├─sda5           Windows8_OS 904,9G ntfs     
├─sda6                         350M ntfs     
└─sda7           PBR_DRV      24,4G ntfs    

loop3                        904,9G          
├─loop3p1 (dm-0) WINRE_DRV    1000M ntfs     
├─loop3p2 (dm-1) SYSTEM_DRV    260M vfat     
├─loop3p3 (dm-2) LRS_ESP       500M vfat     
└─loop3p4 (dm-3)               128M

Remember, back when I ran kpartx -av on the image, loop3p5, p6 and p7 failed to mount.
It looks to me like ddrescue is performing an entire drive image instead of imaging just sda5 partition.
Am I doing ddrescue wrong? Do I need to go back and specify start points and end points.

syg00 · 10-17-2016, 04:47 PM

Quote:

Originally Posted by ronells2000

It looks to me like ddrescue is performing an entire drive image instead of imaging just sda5 partition.
Am I doing ddrescue wrong? Do I need to go back and specify start points and end points.

It was looking like that from the start. I have seen occasions where the partition table gets re-structured to do things like this; never on gpt though - usually involves the extended partition being mis-aligned. This is a problem with the meta-data (partition table), not ddrescue.

Hard to know what to trust without walking through the entire image checking the nominal partition locations reported by the initial parted run against /dev/sda.

ronells2000 · 10-18-2016, 05:42 PM

Can I overwrite the partition table of the image file? I've seen online where people are correcting partition tables on drive, everything I've read say's you can do the same thing to a mounted image as you can on the original drive. I ran some commands to get the partition tables if it helps:

Code:

# parted –list
Model: ATA HGST HTS541010A9 (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical): 512B/4096B
Partition Table: gpt

Number  Start   End     Size    File system  	Name                          	Flags
 1      1049kB  1050MB  1049MB  ntfs                                       		hidden, diag
 2      1050MB  1322MB  273MB   fat32        EFI system partition         	boot
 3      1322MB  1847MB  524MB   fat32                                      		hidden
 4      1847MB  1981MB  134MB                Microsoft reserved partition  	msftres
 5      1981MB  974GB   972GB   ntfs         Basic data partition         	 msftdata
 6      974GB   974GB   367MB   ntfs                                       		hidden, diag
 7      974GB   1000GB  26,2GB  ntfs                                       		hidden, diag
#

Code:

# fdisk -l /dev/sda
GNU Fdisk 1.2.5

Disk /dev/sda: 1000 GB, 1000202273280 bytes
255 heads, 63 sectors/track, 121601 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System 
/dev/sda1               1         128     1028128   83  Linux 
Warning: Partition 1 does not end on cylinder boundary.                   
/dev/sda2   *         128         161      265072   83  Linux 
Warning: Partition 2 does not end on cylinder boundary.                   
/dev/sda3             161         225      514080   83  Linux 
Warning: Partition 3 does not end on cylinder boundary.                   
/dev/sda4             225         241      128520   83  Linux 
Warning: Partition 4 does not end on cylinder boundary.                   
/dev/sda5             241      118370   948871192   83  Linux 
Warning: Partition 5 does not end on cylinder boundary.                   
/dev/sda6          118370      118415      361462   83  Linux 
Warning: Partition 6 does not end on cylinder boundary.                   
/dev/sda7          118415      121602    25599577   83  Linux 
Warning: Partition 7 does not end on cylinder boundary.                   
#

running grep to get what I believe is the original partition:

Code:

# grep sda /proc/partitions
   8        0  976762584 sda
   8        1    1024000 sda1
   8        2     266240 sda2
   8        3     512000 sda3
   8        4     131072 sda4
   8        5  948869120 sda5
   8        6     358400 sda6
   8        7   25600000 sda7
#