# Restore — What Happens After ddrescue Saves Your Data

![](https://cdn.hashnode.com/uploads/covers/645bd7f3d3761288bf03ed2c/1e1243e6-3eac-44d6-b2c3-cc9f79aa4bf8.svg align="center")

> *"ddrescue got your data off the dying drive. Now what? This is where you actually get it back."*

* * *

## 🚑 The Big Picture First

A lot of people think ddrescue *restores* data. It doesn't — not directly.

Here's the honest breakdown:

| Tool | Job | Analogy |
| --- | --- | --- |
| `ddrescue` | Copies a dying drive into a safe image | 🚑 The ambulance |
| `dd` / `mount` / `fsck` | Works with that image to get files back | 🏥 The hospital |
| `TestDisk` / `PhotoRec` | Digs deeper when the filesystem is broken | 🔬 The surgeon |

**ddrescue is step one. Restore is everything after.**

The full journey looks like this:

```plaintext
Dying Drive
    │
    ▼
ddrescue  ──────────►  rescue.img  
             (your safe copy — don't touch the original again)
                              
              ┌─────────────┼──────────────┐
              ▼               ▼                ▼
         Mount it       Clone it      Fix & carve it
       (browse files)  (new drive)   (broken filesystem)
```

* * *

## 🧰 Four Ways to Restore — Pick What Fits

* * *

### 🗂️ Option 1 — Just Browse & Copy Files

**When to use it:** The drive had one bad sector but the filesystem is mostly fine. You just want to grab your documents, photos, etc.

```bash
# Create a mount point
sudo mkdir -p /mnt/recovery

# Mount the image (read-only — always read-only first!)
sudo mount -o loop,ro rescue.img /mnt/recovery

# Browse it like a normal folder
ls /mnt/recovery
cp /mnt/recovery/Documents ~/restored-docs
```

> ✅ Safest option. The `ro` (read-only) flag means you **cannot accidentally modify** your rescued image.

When you're done:

```bash
sudo umount /mnt/recovery
```

* * *

### 💿 Option 2 — Clone the Image onto a New Drive

**When to use it:** You want a full working replacement of the original drive — same partition layout, same OS, same everything — just on new hardware.

```bash
sudo dd if=rescue.img of=/dev/sdb bs=4M status=progress
```

| Part | Meaning |
| --- | --- |
| `if=rescue.img` | Input: your rescued image |
| `of=/dev/sdb` | Output: the new blank drive |
| `bs=4M` | Read/write in 4MB chunks (much faster than default) |
| `status=progress` | Shows live progress so you're not staring at a blank terminal |

> ⚠️ **Double-check** `of=/dev/sdb` — this overwrites the destination completely. Get the device name wrong and you'll overwrite the wrong disk. Run `lsblk` first to confirm.

After cloning, run a filesystem check on the new drive before using it:

```bash
sudo fsck -y /dev/sdb1
```

* * *

### 🔧 Option 3 — Fix a Corrupted Filesystem on the Image

**When to use it:** The image mounted but files are missing, the filesystem shows errors, or `mount` refuses to open it at all.

The image contains a filesystem (ext4, NTFS, FAT32, etc.) that may have been damaged before or during rescue. `fsck` repairs it.

**Step 1 — Set up a loop device so fsck can see the image as a disk:**

```bash
sudo losetup -f --show rescue.img
# Outputs something like: /dev/loop0
```

**Step 2 — Run the filesystem check:**

```bash
# For ext4 (most Linux drives)
sudo fsck.ext4 -y /dev/loop0

# For FAT32 / exFAT (USB drives, SD cards)
sudo fsck.fat -y /dev/loop0

# For NTFS (Windows drives)
sudo ntfsfix /dev/loop0
```

The `-y` flag auto-answers "yes" to all repair prompts.

**Step 3 — Mount and check:**

```bash
sudo mount -o loop /dev/loop0 /mnt/recovery
ls /mnt/recovery
```

**Step 4 — Detach when done:**

```bash
sudo umount /mnt/recovery
sudo losetup -d /dev/loop0
```

* * *

### 🔬 Option 4 — Deep Recovery with TestDisk & PhotoRec

**When to use it:** The partition table is gone, the filesystem is unreadable, files were deleted, or `mount` and `fsck` both fail. This is the surgical option.

These tools work directly on the image file — no mounting required.

* * *

#### 🗺️ TestDisk — Recovers Lost Partitions & Boot Sectors

TestDisk rebuilds the structural layer of a disk — partition tables, boot records, MFT entries. Use it when the drive "disappears" or shows as unallocated space.

```bash
sudo testdisk rescue.img
```

It launches an interactive text UI. The general flow:

```plaintext
1. Select the image file
2. Choose partition table type (usually Intel/MBR or GPT)
3. Analyse → Quick Search
4. If partitions found → Write to fix the table
5. Reboot or re-mount and check
```

> 💡 TestDisk is non-destructive on first analysis — it won't change anything until you explicitly choose **Write**.

* * *

#### 📷 PhotoRec — Carves Raw Files by Signature

PhotoRec ignores the filesystem entirely. It scans raw bytes looking for known file signatures — the magic bytes that mark the start of a JPEG, PDF, ZIP, MP4, and 480+ other formats.

```bash
sudo photorec rescue.img
```

Interactive prompts will ask:

*   Which partition to scan (or the whole image)
    
*   Where to save recovered files (use a **different drive**)
    
*   Which file types to look for (or all of them)
    

**What to expect:** PhotoRec will create folders named `recup_dir.1`, `recup_dir.2`, etc., filled with recovered files. Filenames are generic (`f1234567.jpg`) but the content is intact.

> ⚠️ PhotoRec output can be thousands of files. Give it a separate folder on a large drive.

* * *

## 🗺️ Choosing the Right Tool — Decision Tree

```plaintext
Start here: Do you have rescue.img from ddrescue?
│
├── YES
│    │
│    ├── Can you mount the image normally?
│    │    │
│    │    ├── YES → Option 1: Just mount & copy files
│    │    │
│    │    └── NO
│    │         │
│    │         ├── Want a full working drive clone?
│    │         │    └── YES → Option 2: dd clone to new drive
│    │         │
│    │         ├── Filesystem errors / missing files?
│    │         │    └── YES → Option 3: fsck repair
│    │         │
│    │         └── Partition gone / files deleted / fsck fails?
│    │              └── YES → Option 4: TestDisk + PhotoRec
│    │
└── NO → Go run ddrescue first!
```

* * *

## 🔢 The Complete Workflow — Start to Finish

Here's the full rescue-and-restore process in one place:

**Step 1 — Rescue the dying drive:**

```bash
# Pass 1: fast sweep
sudo ddrescue -d -n /dev/sda rescue.img rescue.log

# Pass 2: targeted retry on bad sectors
sudo ddrescue -d -r3 /dev/sda rescue.img rescue.log
```

**Step 2 — Try the simple mount first:**

```bash
sudo mount -o loop,ro rescue.img /mnt/recovery
# If this works, just copy your files and you're done
```

**Step 3 — If mount fails, repair the filesystem:**

```bash
sudo losetup -f --show rescue.img   # get /dev/loop0
sudo fsck.ext4 -y /dev/loop0
sudo mount /dev/loop0 /mnt/recovery
```

**Step 4 — If files are still missing, use PhotoRec:**

```bash
sudo photorec rescue.img
```

**Step 5 — If you want a full clone on a new drive:**

```bash
sudo dd if=rescue.img of=/dev/sdb bs=4M status=progress
sudo fsck -y /dev/sdb1
```

* * *

## 🛡️ Golden Rules of Restore

**1\. Never modify the original device again.** Once ddrescue has the image, the original drive's job is done. Unplug it. Store it somewhere safe. Every extra read shortens its life.

**2\. Always try read-only mount first.** Before running any repair tool, try `mount -o ro`. If your files are there, you're done — no need to risk a repair operation.

**3\. Work from the image, not a copy of the image.** Repair tools like `fsck` modify the image in place. Keep a backup copy of `rescue.img` before running them — just in case a repair makes things worse.

```bash
cp rescue.img rescue_backup.img   # keep a clean copy first
sudo fsck.ext4 -y /dev/loop0      # now repair the working copy
```

**4\. Save recovered files to a different drive.** Never save PhotoRec output back to the same image or the same drive you're recovering from.

**5\. Be patient with PhotoRec.** It can take hours on a large drive. Let it finish. Interrupting it mid-scan loses progress.

* * *

## 📦 Tool Summary

| Tool | What it fixes | Install |
| --- | --- | --- |
| `mount` | Browse a working filesystem | Built-in |
| `dd` | Clone image to a new physical drive | Built-in |
| `fsck` | Repairs corrupted filesystem structures | Built-in |
| `ntfsfix` | Basic NTFS repair (Windows drives) | `ntfs-3g` package |
| **TestDisk** | Lost partitions, deleted boot sectors | `testdisk` package |
| **PhotoRec** | Carves files when filesystem is gone | Ships with `testdisk` |

Install TestDisk + PhotoRec in one go:

```bash
# Ubuntu / Debian
sudo apt install testdisk

# Fedora
sudo dnf install testdisk

# macOS
brew install testdisk
```

* * *

Hence, The restore phase is where you actually *get your data back* — ddrescue just made it possible. In order of effort:

1.  **Try mounting first** — takes 10 seconds, might be all you need
    
2.  **Run fsck** — fixes most filesystem-level problems
    
3.  **Use TestDisk** — for lost partitions and structural damage
    
4.  **Use PhotoRec** — the last resort that still finds files when everything else fails
    

Most recoveries end at step 1 or 2. The deeper tools exist for the hard cases — and they're genuinely good at what they do.

* * *

*Companion to the ddrescue guide · TestDisk/PhotoRec by Christophe Grenier ·* [*TestDisk Docs*](https://www.cgsecurity.org/wiki/TestDisk)