cgsecurity.org

I have a 3TiB drive that I need to recover.

It was a USB drive and one day when plugged in it showed up as unpartitioned. I pulled the drive out of its case and plugged it straight to the motherboard and still the same problem. Testdisk was able to see all the files, so I put the drive away until I had another drive large enough to transfer all the data.

I now have a USB drive large enough so I decided to do the recovery. I plugged the drive in and windows could see the partition. Straight away I tried copying all the files to the new drive using Total Commander, but the copy slowed to a crawl and brought the whole machine to it knees. Same thing when trying with TestDisk.

I decided to put the drive into a linux machine and use ddrescue to dump an image of the drive onto the USB disk using:

ddrescue -n /dev/sdc1 /mnt/tmp/recover/ddrescue.img rescue.log

ddrescue manged to rip through the first 8GiB and then crawled to a halt and spent the next 11hrs to do another 48MiB with an average speed of ~3900 B/s and an estimation of 32 years to finish.

I've stopped ddrescue and hope that someone can help me out with some advice on how to proceed from here.

ddrescue remains the best option but you can optimize it using domain files. Domain files are useful to skip unused area of the disk, you can create them using ddrutility or partclone.

Made a domain file using partclone:

partclone.ntfs -D -s /dev/sdc1 -o domain.log

The ran the following:

ddrescue -n -d -m domain.log /dev/sdc1 /mnt/tmp/recover/ddrescue.img rescue.log

Managed to get another ~3GiB done in 17hrs at an average of ~6800B/s and an estimated runtime of 11 years. So it is a bit of an improvement, but not really enough.

Somehow I think the disk will give up the ghost long before I get an image from it.