home |
electronics |
toolbox |
science club |
tuxtalk |
photos |
e-cards |
online-shop
December 2025
ddrescue to restore data from an intel ssd
Intel used to make quality SSD disks in the early days of this technology. In recent years
they have optimized for performance and lost sight of the fact that it was meant as a storage
device. One of my laptops with an intel ssd bought in 2019 failed this year. It failed at disk
check and produced corrupted photos. I had used this computer to store photos from my camera.
The good news is that I have been able to restore all the data using a linux software called
ddrescue. I have not lost one file. Here is how I did it.
Shutdown and don't write
When the laptop produced corrupted photos and failed a filesystem check I did not make any
attempts to repair the filesystem. I shut the machine down and took the disk out. It's a 2.5inch
intel sata ssd. I ordered two used samsung sata ssd disks on ebay and I just waited until they
arrived. I ordered also two sata to usb adapters.
Procedure
- Attach the broken ssd via a sata to usb adapter to a linux pc and use
the software smartctl to print statistics about disk:
smartctl -a /dev/sdb
Look at reallocated sector count and CRC counts.
- smartctl allows you to run a self test. In intel's case such a self-test seems to also
make the disk firmware aware of bad memory areas and it seems that it can then recover data
using checksums and redundancy that is built into the disk:
smartctl -t short /dev/sdb
The self test came back as failed.
- The linux command dd could be used to make a full copy of the disk but it has the
problem that it will hang and fail at the first block that is not readable. This is not what you want. The files that are most likely corrupted are /tmp files and log files. They get written all the time. I had some unrecoverable files from /var/log but all the photos that appeared originally broken
came finally back OK. The command ddrescue is similar to dd but it can do multiple non blocking
read attempts and recover this way files that are sometimes readable. On ubuntu you install
ddrescue with the command:
apt-get install gddrescue
- The two samsung SSDs that I bought were bigger than the intel SSD. I attached the first
samsung ssd also via a sata to usb adapter the linux computer which I used for recovery and made
a full raw copy of the intel disk. /dev/sdb is the broken intel ssd, /dev/sdc is the bigger samsung ssd.
Use the "smartctl -a" to double check the disks. You don't want to accidently copy in the wrong direction or overwrite the disk of the linux pc which you are using for the recovery. Note down the device names.
root@milkyway:~# ddrescue -f /dev/sdb /dev/sdc /root/ddrescue-1.log
This makes a copy where possible and creates a log file which allows you to
run ddrescue a second time and only copy the blocks that failed the first time.
This command took about 30min to run.
- The first ddrescue copy was almost successful and only a few blocks which were not readable.
I re-run the ddrescue a second time while reading only blocks that failed the first time:
root@milkyway:~# ddrescue -f -n -r 1 /dev/sdb /dev/sdc /root/ddrescue-1.log
This second attempt recovered all blocks except for some that were related to log files.
- Print the partition table of the copied disk (samsung disk):
fdisk -l /dev/sdc
Run fsck on the partitions.
- Now I had a functioning copy of the intel disk and I could have used it but I wanted to
use the extra space of the new disk. The samsung copy looked like this:
root@milkyway:~# fdisk -l /dev/sdc
Disk /dev/sdc: 465.78 GiB, 500107862016 bytes, 976773168 sectors
Disk model: SSD 850 EVO 500G
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x0f8f9e39
Device Boot Start End Sectors Size Id Type
/dev/sdc1 * 2048 6000639 5998592 2.9G 83 Linux
/dev/sdc2 6000640 10000383 3999744 1.9G 82 Linux swap / Solaris
/dev/sdc3 10000384 234440703 224440320 107G 83 Linux
You see that it is a 500G disk but the main partition (sdc3, corresponds to / ) is only
107G big. If I would plug that disk back into the laptop then it would only have a
107G root partition (file system /, under linux). I made therefore a raw copy of
the boot sector and partition table to the second samsung disk which I had bought
and then I deleted partition 3 and replaced it with a bigger empty partition. I would then
copy the content of that 3rd partition into the bigger partition (file copy, not raw copy).
- Unplug the defect intel ssd and plug the second empty samsung ssd instead into the
computer (via sata to usb adapter). The setup is now: /dev/sdc = 1st samsung disk with all
the recovered data. /dev/sdb 2nd samsung disk empty.
I copy now the partition table, boot sector, boot partition (/dev/sdc1) and a bit of
the other partition to the empty disk. I use the normal dd command because these disks
are fully functional
dd if=/dev/sdc of=/dev/sdb bs=512 count=6000640 status=progress
- Format the swap partition of the empty samsung disk (sdb2) and delete sdb3. Re-create
sdb3 to fill the whole disk:
root@milkyway:~# mkswap /dev/sdb2
root@milkyway:~# fdisk /dev/sdb
delete partition 3 (fdisk command d), re-created it as new partition and then write the partition table.
Make an empty filesystem on sdb3:
root@milkyway:~# mkfs.ext4 /dev/sdb3
- Copy now the content (not the partition) of sdc3 (samsung disk with recovered data) into sdb3 (samsung disk with big 3rd partition but no data). Create two mount points to do the copying.
mkdir /tmp/mntsdb3
mkdir /tmp/mntsdc3
mount /dev/sdb3 /tmp/mntsdb3
mount /dev/sdc3 /tmp/mntsdc3
cd /tmp/mntsdc3
find . | cpio -V -dump /tmp/mntsdb3
cd
umount /dev/sdb3 /tmp/mntsdb3
umount /dev/sdc3 /tmp/mntsdc3
- Now we have two usable samsung disks. The first one is just a raw copy of the original intel
disk and the second one is also a copy but has a much bigger 3rd partition (=root partition in this case). We can't plug it like that into the computer because the partition id has changed due to the hardware change. The kernel will boot but it will not find the root partition. Use the command "blkid" to find the new blkid of the root partition (mount sdb3 and run comand blkid). Note the long uuid number down. It will be something like UUID=797f952d-6465-4e42-9f8b-f5fb97857048
- Install the "big samsung disk" in the labtop and boot.
Wait for the GRUB menu to show (if you don't see a GRUB menu, press and hold the Left Shift key right after starting the system).
Now highlight the kernel you want to use, and press the e key. You should be able to see and edit the commands associated with the highlighted kernel.
Go down to the line starting with linux and edit the command parameters.
Look for a parameter called root (for root partition) and write:
root=UUID=797f952d-6465-4e42-9f8b-f5fb97857048
Now press Ctrl+x to boot.
- The computer should boot properly. Become root and edit /etc/fstab (vi /etc/fstab). Replace the uuid of the old
root partition (from intel disk) with the uuid of the new one (samsung disk). Something like
UUID=797f952d-6465-4e42-9f8b-f5fb97857048 / ext4 errors=remount-ro 0 1
- Re-write the boot sector:
update-grub
- reboot the computer and now it should boot without the need to do any editing in the grub menu.
The computer is fully restored with all the data and you have a bigger disk partition with more
extra space.
Conclusion: Buy only original samsung disks made in korea. Intel can no longer be trusted and
I am also avoiding made in china samsung disks. Note that there are some fake SSDs out there.
Fake disks have often poor quality stickers and the disk serial number on the sticker may be different
from the serial number read via smartctl -a. If you want to save money and avoid fake disks then buy used server ssd disks.
It seems that the ssd error correction algorithm can recover some data when damaged blocks are read a second time with ddrescue.
Back to NPA blog index
© 2004-2025 Guido Socher