Restore — What Happens After ddrescue Saves Your Data

"ddrescue got your data off the dying drive. Now what? This is where you actually get it back."

🚑 The Big Picture First

A lot of people think ddrescue restores data. It doesn't — not directly.

Here's the honest breakdown:

ddrescue is step one. Restore is everything after.

The full journey looks like this:

Dying Drive
    │
    ▼
ddrescue  ──────────►  rescue.img  
             (your safe copy — don't touch the original again)
                              
              ┌─────────────┼──────────────┐
              ▼               ▼                ▼
         Mount it       Clone it      Fix & carve it
       (browse files)  (new drive)   (broken filesystem)

🧰 Four Ways to Restore — Pick What Fits

🗂️ Option 1 — Just Browse & Copy Files

When to use it: The drive had one bad sector but the filesystem is mostly fine. You just want to grab your documents, photos, etc.

# Create a mount point
sudo mkdir -p /mnt/recovery

# Mount the image (read-only — always read-only first!)
sudo mount -o loop,ro rescue.img /mnt/recovery

# Browse it like a normal folder
ls /mnt/recovery
cp /mnt/recovery/Documents ~/restored-docs

✅ Safest option. The ro (read-only) flag means you cannot accidentally modify your rescued image.

When you're done:

sudo umount /mnt/recovery

💿 Option 2 — Clone the Image onto a New Drive

When to use it: You want a full working replacement of the original drive — same partition layout, same OS, same everything — just on new hardware.

sudo dd if=rescue.img of=/dev/sdb bs=4M status=progress

⚠️ Double-check of=/dev/sdb — this overwrites the destination completely. Get the device name wrong and you'll overwrite the wrong disk. Run lsblk first to confirm.

After cloning, run a filesystem check on the new drive before using it:

sudo fsck -y /dev/sdb1

🔧 Option 3 — Fix a Corrupted Filesystem on the Image

When to use it: The image mounted but files are missing, the filesystem shows errors, or mount refuses to open it at all.

The image contains a filesystem (ext4, NTFS, FAT32, etc.) that may have been damaged before or during rescue. fsck repairs it.

Step 1 — Set up a loop device so fsck can see the image as a disk:

sudo losetup -f --show rescue.img
# Outputs something like: /dev/loop0

Step 2 — Run the filesystem check:

# For ext4 (most Linux drives)
sudo fsck.ext4 -y /dev/loop0

# For FAT32 / exFAT (USB drives, SD cards)
sudo fsck.fat -y /dev/loop0

# For NTFS (Windows drives)
sudo ntfsfix /dev/loop0

The -y flag auto-answers "yes" to all repair prompts.

Step 3 — Mount and check:

sudo mount -o loop /dev/loop0 /mnt/recovery
ls /mnt/recovery

Step 4 — Detach when done:

sudo umount /mnt/recovery
sudo losetup -d /dev/loop0

🔬 Option 4 — Deep Recovery with TestDisk & PhotoRec

When to use it: The partition table is gone, the filesystem is unreadable, files were deleted, or mount and fsck both fail. This is the surgical option.

These tools work directly on the image file — no mounting required.

🗺️ TestDisk — Recovers Lost Partitions & Boot Sectors

TestDisk rebuilds the structural layer of a disk — partition tables, boot records, MFT entries. Use it when the drive "disappears" or shows as unallocated space.

sudo testdisk rescue.img

It launches an interactive text UI. The general flow:

1. Select the image file
2. Choose partition table type (usually Intel/MBR or GPT)
3. Analyse → Quick Search
4. If partitions found → Write to fix the table
5. Reboot or re-mount and check

💡 TestDisk is non-destructive on first analysis — it won't change anything until you explicitly choose Write.

📷 PhotoRec — Carves Raw Files by Signature

PhotoRec ignores the filesystem entirely. It scans raw bytes looking for known file signatures — the magic bytes that mark the start of a JPEG, PDF, ZIP, MP4, and 480+ other formats.

sudo photorec rescue.img

Interactive prompts will ask:

• Which partition to scan (or the whole image)

• Where to save recovered files (use a different drive)

• Which file types to look for (or all of them)

What to expect: PhotoRec will create folders named recup_dir.1, recup_dir.2, etc., filled with recovered files. Filenames are generic (f1234567.jpg) but the content is intact.

⚠️ PhotoRec output can be thousands of files. Give it a separate folder on a large drive.

🗺️ Choosing the Right Tool — Decision Tree

Start here: Do you have rescue.img from ddrescue?
│
├── YES
│    │
│    ├── Can you mount the image normally?
│    │    │
│    │    ├── YES → Option 1: Just mount & copy files
│    │    │
│    │    └── NO
│    │         │
│    │         ├── Want a full working drive clone?
│    │         │    └── YES → Option 2: dd clone to new drive
│    │         │
│    │         ├── Filesystem errors / missing files?
│    │         │    └── YES → Option 3: fsck repair
│    │         │
│    │         └── Partition gone / files deleted / fsck fails?
│    │              └── YES → Option 4: TestDisk + PhotoRec
│    │
└── NO → Go run ddrescue first!

🔢 The Complete Workflow — Start to Finish

Here's the full rescue-and-restore process in one place:

Step 1 — Rescue the dying drive:

# Pass 1: fast sweep
sudo ddrescue -d -n /dev/sda rescue.img rescue.log

# Pass 2: targeted retry on bad sectors
sudo ddrescue -d -r3 /dev/sda rescue.img rescue.log

Step 2 — Try the simple mount first:

sudo mount -o loop,ro rescue.img /mnt/recovery
# If this works, just copy your files and you're done

Step 3 — If mount fails, repair the filesystem:

sudo losetup -f --show rescue.img   # get /dev/loop0
sudo fsck.ext4 -y /dev/loop0
sudo mount /dev/loop0 /mnt/recovery

Step 4 — If files are still missing, use PhotoRec:

sudo photorec rescue.img

Step 5 — If you want a full clone on a new drive:

sudo dd if=rescue.img of=/dev/sdb bs=4M status=progress
sudo fsck -y /dev/sdb1

🛡️ Golden Rules of Restore

1. Never modify the original device again. Once ddrescue has the image, the original drive's job is done. Unplug it. Store it somewhere safe. Every extra read shortens its life.

2. Always try read-only mount first. Before running any repair tool, try mount -o ro. If your files are there, you're done — no need to risk a repair operation.

3. Work from the image, not a copy of the image. Repair tools like fsck modify the image in place. Keep a backup copy of rescue.img before running them — just in case a repair makes things worse.

cp rescue.img rescue_backup.img   # keep a clean copy first
sudo fsck.ext4 -y /dev/loop0      # now repair the working copy

4. Save recovered files to a different drive. Never save PhotoRec output back to the same image or the same drive you're recovering from.

5. Be patient with PhotoRec. It can take hours on a large drive. Let it finish. Interrupting it mid-scan loses progress.

📦 Tool Summary

Install TestDisk + PhotoRec in one go:

# Ubuntu / Debian
sudo apt install testdisk

# Fedora
sudo dnf install testdisk

# macOS
brew install testdisk

Hence, The restore phase is where you actually get your data back — ddrescue just made it possible. In order of effort:

1. Try mounting first — takes 10 seconds, might be all you need

2. Run fsck — fixes most filesystem-level problems

3. Use TestDisk — for lost partitions and structural damage

4. Use PhotoRec — the last resort that still finds files when everything else fails

Most recoveries end at step 1 or 2. The deeper tools exist for the hard cases — and they're genuinely good at what they do.

Companion to the ddrescue guide · TestDisk/PhotoRec by Christophe Grenier · TestDisk Docs