Recovering large files from damaged HD

I have an 8tb external drive with a mechanical failure. It holds mostly Time Machine images. I need one of the backups, and discovered the problem when a restore failed about 3/4 of the way. The drive mounts and copying is possible, but:

  1. Finder copying a 600GB TM image fails about 150 GB in, apparently when it hits unreadable sectors;
  2. Mounting the TM image works, and I tried to clone one of the backups using Carbon Copy Cloner, but it eventually failed while cataloguing the files to be copied (about 2 million files in).


I just want to find a way to complete a copy, skipping over bad sectors rather than just choking and giving up.

Earlier Mac models

Posted on Mar 16, 2023 9:24 AM

Reply
Question marked as Top-ranking reply

Posted on Mar 18, 2023 12:35 PM

You will want to use GNU ddrescue which is usually available in most Linux distribution's software repositories.


It is best to use GNU ddrescue from a Linux system because macOS tends to get in the way and is unable to deal with all the I/O errors produced by a failing drive.


Make sure to read the documentation as it explains how the utility works and also mentions some things to be careful about such as how drive identifiers can change between reboots and between reconnecting devices & drives. You always want to reference a "mapfile" so you can resume any aborted scans.


The hard part of this data recovery process is the waiting as it will take a long time especially on a large drive. It is even harder when seeing errors accumulate, but later passes will change these values and hopefully the amount of data listed in "Bad Sectors" grows smaller even if the number of errors increase.


You cannot stop the process and attempt to access the clone as you will end up modifying the contents of the clone...so you must wait until you have decided the recovery process has retrieved as much data as it is likely to get. Then and only then do you attempt to mount the cloned copy of the drive. Personally if I feel the clone may have issues, then I will then clone the clone so I can work from the 2nd clone. If I make a mistake trying to fix the file system in order to access the data, then I still have my first clone available to start over. I assume the original source drive is now too damaged to be used as a source again so the first clone is the best copy we have of the contents.


You may need to run Disk Utilty First Aid on the physical drive of the clone, as well as on the partition. If it is an HFS+ partition, then you do have some extra options like running the paid third party app Disk Warrior to attempt repairs on an HFS+ partition/volume, but unfortunately this is not an option if the partition/volume is using the APFS file system (there are no third party utilities for repairing the APFS file system...at least nothing significant or worth any money).


Unfortunately being a TM backup drive, data recovery apps are probably not very useful. Also, the likelihood of even this type of clone being successful to access the TM backup is slim due to all the links which are used to maintain the structure of the backups. Standard macOS data drives don't have these complex links so recovering & accessing data from a clone made this way is usually fairly easy & straight forward as standard data recovery apps can be used on the clone if the drive's file system is too damaged to be mounted normally.


Generally the command is something like this generalized template:

sudo  ddrescue  --ask  -f  <source-drive>   <destination-drive>   <mapfile>.txt


So, assuming the source drive is "dev/sda", and the blank destination drive which is the same or larger than the source is "/dev/sdb" (confirm the drive identifiers for each drive each time before you issue any "ddrescue" commands), then the command would be:

sudo  ddrescue  --ask  -f  /dev/sda  /dev/sdb  ~/mapfile_rescue_2023-03-18.txt


The other common options which you may use are:

-n skip scraping phase -- the documentation used to mention this was a good option for the first attempt.


-r X retry "X" number of times to read the bad sectors (usually you wait until after most of the data drive is copied. Can be -rX as well with no space between the option and the number.


-R Reverse direction of the scan---start at the end of the drive & move forward. Can be useful if the damaged area of the drive is at the beginning.


Similar questions

9 replies
Question marked as Top-ranking reply

Mar 18, 2023 12:35 PM in response to nxnw

You will want to use GNU ddrescue which is usually available in most Linux distribution's software repositories.


It is best to use GNU ddrescue from a Linux system because macOS tends to get in the way and is unable to deal with all the I/O errors produced by a failing drive.


Make sure to read the documentation as it explains how the utility works and also mentions some things to be careful about such as how drive identifiers can change between reboots and between reconnecting devices & drives. You always want to reference a "mapfile" so you can resume any aborted scans.


The hard part of this data recovery process is the waiting as it will take a long time especially on a large drive. It is even harder when seeing errors accumulate, but later passes will change these values and hopefully the amount of data listed in "Bad Sectors" grows smaller even if the number of errors increase.


You cannot stop the process and attempt to access the clone as you will end up modifying the contents of the clone...so you must wait until you have decided the recovery process has retrieved as much data as it is likely to get. Then and only then do you attempt to mount the cloned copy of the drive. Personally if I feel the clone may have issues, then I will then clone the clone so I can work from the 2nd clone. If I make a mistake trying to fix the file system in order to access the data, then I still have my first clone available to start over. I assume the original source drive is now too damaged to be used as a source again so the first clone is the best copy we have of the contents.


You may need to run Disk Utilty First Aid on the physical drive of the clone, as well as on the partition. If it is an HFS+ partition, then you do have some extra options like running the paid third party app Disk Warrior to attempt repairs on an HFS+ partition/volume, but unfortunately this is not an option if the partition/volume is using the APFS file system (there are no third party utilities for repairing the APFS file system...at least nothing significant or worth any money).


Unfortunately being a TM backup drive, data recovery apps are probably not very useful. Also, the likelihood of even this type of clone being successful to access the TM backup is slim due to all the links which are used to maintain the structure of the backups. Standard macOS data drives don't have these complex links so recovering & accessing data from a clone made this way is usually fairly easy & straight forward as standard data recovery apps can be used on the clone if the drive's file system is too damaged to be mounted normally.


Generally the command is something like this generalized template:

sudo  ddrescue  --ask  -f  <source-drive>   <destination-drive>   <mapfile>.txt


So, assuming the source drive is "dev/sda", and the blank destination drive which is the same or larger than the source is "/dev/sdb" (confirm the drive identifiers for each drive each time before you issue any "ddrescue" commands), then the command would be:

sudo  ddrescue  --ask  -f  /dev/sda  /dev/sdb  ~/mapfile_rescue_2023-03-18.txt


The other common options which you may use are:

-n skip scraping phase -- the documentation used to mention this was a good option for the first attempt.


-r X retry "X" number of times to read the bad sectors (usually you wait until after most of the data drive is copied. Can be -rX as well with no space between the option and the number.


-R Reverse direction of the scan---start at the end of the drive & move forward. Can be useful if the damaged area of the drive is at the beginning.


Mar 27, 2023 10:50 AM in response to HWTech

Long story short - once I got past the learning curve, I might have been able to recover a fair bit but it would have taken more time than it was worth.


Longer story:

I saw no realistic potential and no significant utility for restoring the entire 8TB drive, as the drive was already replaced and all of the computers (other than the one I wanted to restore to) now had fresh TM backups. I decided to try ddrescue on the sparse bundle containing that backup.


It was necessary to attach, but not mount, in order to attempt recovery:

hdiutil attach -nomount /Volumes/8TB\ Backup/TM\ Backups/2014Mini.sparsebundle

First Problem: ddrescue thought the attached image was multiple petabytes in size. This appears to have been addressed with the --size option.


Remaining efforts were based on this command:

sudo  ddrescue  --ask -f --size=690630741196  -n /dev/disk5s2  /Volumes/Backup/recovered\ backup/TM.dmg  /Volumes/Backup/recovered\ backup/mapfile_rescue_2023-03-23.txt


Second problem: drive started thrashing and clanging about 20 GB in - concerned about damage, I stopped the recovery after a couple of minutes of noise with no change in any of the numbers reported by ddrescue. Tried:

• the -R option to start from the back. It went about 50 GB before thrashing and clanging and, again, I cancelled. • using the --input-position option (-i did not work, btw) to manually skip over the bad area. No good. It appeared to work, but then I noticed that the recovery image was now larger by the amount to the --input-position option. Evidently, combined with --size I had made a fantasy drive that did not accord with reality and presumably ruined my mapfile.

• started over.


Final problem: I tried some other options (i.e.--min-read-rate, --retrim) and made some progress, starting and stopping, but even assuming I would end up with a useful recovered drive image (not a sure thing), it was going to take too much time and attention. I did have a cloud backup of the home folder, so losing the TM backup was not going to be a disaster. Restoring the home folder from the cloud backup, reinstalling the apps and doing some manual configuration was a sure thing and would take much less time and effort.


In any event, thanks for your suggestion. If I didn't have the cloud backup, I would have persisted.


The moral of the story, however, is that redundant backups can be a lifesaver.

Mar 16, 2023 2:31 PM in response to nxnw

Disk drill…

https://www.cleverfiles.com/

Disk Drill - Best Free Mac Data Recovery Software in 2023! (cleverfiles.com)


on file recovery...

Trccharleshanks to Kurt Lang…


I had to recently recover a file I deleted (about a month ago). FileSalvage ran, but the way it accesses the drive to look for deleted items is incredibly slow. My version of Data Rescue was too old to run in Monterey. But it also suffers from the hours long process of examining a drive.


SubRosaSoft (FileSalvage) folded. If you go to subrosasoft.com, this is all you get. A very simple few lines of text:


Thank you to all of our customers over the years. SubRosaSoft has regretfully closed up shop. Inquiries regarding purchase of our domain or software assets may be directed to mhurlow@subrosasoft.com.


Data Rescue is still available, but is now subscription only. No way was I paying those prices for something I use less than once a year. That sent me on a search for something better.


I haven't tried Stellar's product, so I can't comment on that one. But I did test Disk Drill.


It'll do three free recoveries before you have to pay for it. But the kicker is the speed. I ran it and it said it was ready in less than 30 seconds (if it was even that long). Since every recovery software I had ever used before took a minimum of 8 hours to look through a 1 TB drive, I figured that couldn't be right. So I set if for a deep scan. Also done in less than 30 seconds. Easily found and recovered my file.


I don't know what methods their app uses to locate deleted items, but I didn't hesitate to purchase the full version for something that works that fast.


"Stellar Phoenix Macintosh - Mac data recovery software, recovers data from damaged, deleted, or corrupted volumes and even from initialized disks."

They have a trial version, so I guess you can see if your data can be recovered...

http://www.stellarinfo.com/mac-data-recovery.htm


Disk drill…

https://www.cleverfiles.com/

Disk Drill - Best Free Mac Data Recovery Software in 2023! (cleverfiles.com)


on file recovery...

Trccharleshanks to Kurt Lang…


I had to recently recover a file I deleted (about a month ago). FileSalvage ran, but the way it accesses the drive to look for deleted items is incredibly slow. My version of Data Rescue was too old to run in Monterey. But it also suffers from the hours long process of examining a drive.


SubRosaSoft (FileSalvage) folded. If you go to subrosasoft.com, this is all you get. A very simple few lines of text:


Thank you to all of our customers over the years. SubRosaSoft has regretfully closed up shop. Inquiries regarding purchase of our domain or software assets may be directed to mhurlow@subrosasoft.com.


Data Rescue is still available, but is now subscription only. No way was I paying those prices for something I use less than once a year. That sent me on a search for something better.


I haven't tried Stellar's product, so I can't comment on that one. But I did test Disk Drill.


It'll do three free recoveries before you have to pay for it. But the kicker is the speed. I ran it and it said it was ready in less than 30 seconds (if it was even that long). Since every recovery software I had ever used before took a minimum of 8 hours to look through a 1 TB drive, I figured that couldn't be right. So I set if for a deep scan. Also done in less than 30 seconds. Easily found and recovered my file.


I don't know what methods their app uses to locate deleted items, but I didn't hesitate to purchase the full version for something that works that fast.


"Stellar Phoenix Macintosh - Mac data recovery software, recovers data from damaged, deleted, or corrupted volumes and even from initialized disks."

They have a trial version, so I guess you can see if your data can be recovered...

http://www.stellarinfo.com/mac-data-recovery.htm

Mar 18, 2023 10:15 AM in response to HWTech

Please provide the utility name. I am comfortable with the command line and can also use linux if need be. The drive is certainly a write-off, so if this finishes it off, it isn't the end of the world. I just want to recover what I can. Thanks.


I do have another non-TM backup, but being able to recover most of the TM backup would let me restore using migration assistant. It is highly likely that whatever is on the bad sectors is unimportant anyway.


Responding the the other person's suggestion that "other Recovery SW may try bad sectors a hundred times or until more than half the reads concur on the data" - that's exactly what I don't want to do. I want to skip over the bad sectors after one try and just carry on with the good sectors. I don't want the drive clanking for half an hour causing more damage.

Mar 17, 2023 6:22 PM in response to nxnw

If the TM drive is failing, then all the attempts you are trying is making the hardware failure worse. There is only one way to clone a failing hard drive and that is by using a command line utility to perform a low level bit for bit clone, but this process may end up killing the drive by the time it is finished. It also requires being familiar with the command line, but even then it is easy to make a mistake mixing up source & destinations thereby destroying the data you are trying to recover. If there are errors, this utility won't ever complete so the user must make a decision when to stop the attempt. While technically this third party command line utility will work on macOS, I find that macOS gets in the way of the process because macOS cannot handle the errors produced by a failing drive.


I gave up on using macOS to perform data recovery like this even for macOS drives and only do so now using a Linux system.


I am not aware of any other macOS app which will do this type of clone since all the other apps are just using a file copy mechanism, or possibly using the "asr" streaming command to transfer APFS snapshots/volumes.


I've never tried to clone a TM backup drive, only standard macOS boot drives. TM has a much more complicated file structure so even a low level bit for bit clone may not be able to salvage the backups with all the links they use. Even with Drive Savers you may still have this problem. Drive Savers does provide free estimates and this is one of the questions you can ask them whether it is even worthwhile to attempt recovering from a failing TM backup drive.


I can provide the utility name if interested, but like I said even this is risky. I can only provide very basic instructions since it would require a huge post to provide exact details, and even then you will be responsible for taking what I say and applying it to your situation....if applied incorrectly, you may destroy the backup.


This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Recovering large files from damaged HD

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.