home |  electronics |  toolbox |  science club |  tuxtalk |  photos |  e-cards |  online-shop



December 2025

ddrescue to restore data from an intel ssd

Intel used to make quality SSD disks in the early days of this technology. In recent years they have optimized for performance and lost sight of the fact that it was meant as a storage device. One of my laptops with an intel ssd bought in 2019 failed this year. It failed at disk check and produced corrupted photos. I had used this computer to store photos from my camera.

The good news is that I have been able to restore all the data using a linux software called ddrescue. I have not lost one file. Here is how I did it.

Shutdown and don't write

When the laptop produced corrupted photos and failed a filesystem check I did not make any attempts to repair the filesystem. I shut the machine down and took the disk out. It's a 2.5inch intel sata ssd. I ordered two used samsung sata ssd disks on ebay and I just waited until they arrived. I ordered also two sata to usb adapters.

Procedure

  1. Attach the broken ssd via a sata to usb adapter to a linux pc and use the software smartctl to print statistics about disk:
    smartctl -a /dev/sdb
    Look at reallocated sector count and CRC counts.
  2. smartctl allows you to run a self test. In intel's case such a self-test seems to also make the disk firmware aware of bad memory areas and it seems that it can then recover data using checksums and redundancy that is built into the disk:
    smartctl -t short /dev/sdb
    The self test came back as failed.
  3. The linux command dd could be used to make a full copy of the disk but it has the problem that it will hang and fail at the first block that is not readable. This is not what you want. The files that are most likely corrupted are /tmp files and log files. They get written all the time. I had some unrecoverable files from /var/log but all the photos that appeared originally broken came finally back OK. The command ddrescue is similar to dd but it can do multiple non blocking read attempts and recover this way files that are sometimes readable. On ubuntu you install ddrescue with the command:
    apt-get install gddrescue
  4. The two samsung SSDs that I bought were bigger than the intel SSD. I attached the first samsung ssd also via a sata to usb adapter the linux computer which I used for recovery and made a full raw copy of the intel disk. /dev/sdb is the broken intel ssd, /dev/sdc is the bigger samsung ssd. Use the "smartctl -a" to double check the disks. You don't want to accidently copy in the wrong direction or overwrite the disk of the linux pc which you are using for the recovery. Note down the device names.
    root@milkyway:~# ddrescue -f /dev/sdb /dev/sdc /root/ddrescue-1.log
    This makes a copy where possible and creates a log file which allows you to run ddrescue a second time and only copy the blocks that failed the first time. This command took about 30min to run.
  5. The first ddrescue copy was almost successful and only a few blocks which were not readable. I re-run the ddrescue a second time while reading only blocks that failed the first time:
    root@milkyway:~# ddrescue -f -n -r 1 /dev/sdb /dev/sdc /root/ddrescue-1.log
    This second attempt recovered all blocks except for some that were related to log files.
  6. Print the partition table of the copied disk (samsung disk):
    fdisk -l /dev/sdc
    Run fsck on the partitions.
  7. Now I had a functioning copy of the intel disk and I could have used it but I wanted to use the extra space of the new disk. The samsung copy looked like this:
    root@milkyway:~# fdisk -l /dev/sdc
    Disk /dev/sdc: 465.78 GiB, 500107862016 bytes, 976773168 sectors
    Disk model: SSD 850 EVO 500G
    Units: sectors of 1 * 512 = 512 bytes
    Sector size (logical/physical): 512 bytes / 4096 bytes
    I/O size (minimum/optimal): 4096 bytes / 4096 bytes
    Disklabel type: dos
    Disk identifier: 0x0f8f9e39
    
    Device     Boot    Start       End   Sectors  Size Id Type
    /dev/sdc1  *        2048   6000639   5998592  2.9G 83 Linux
    /dev/sdc2        6000640  10000383   3999744  1.9G 82 Linux swap / Solaris
    /dev/sdc3       10000384 234440703 224440320  107G 83 Linux
    
    You see that it is a 500G disk but the main partition (sdc3, corresponds to / ) is only 107G big. If I would plug that disk back into the laptop then it would only have a 107G root partition (file system /, under linux). I made therefore a raw copy of the boot sector and partition table to the second samsung disk which I had bought and then I deleted partition 3 and replaced it with a bigger empty partition. I would then copy the content of that 3rd partition into the bigger partition (file copy, not raw copy).
  8. Unplug the defect intel ssd and plug the second empty samsung ssd instead into the computer (via sata to usb adapter). The setup is now: /dev/sdc = 1st samsung disk with all the recovered data. /dev/sdb 2nd samsung disk empty.
    I copy now the partition table, boot sector, boot partition (/dev/sdc1) and a bit of the other partition to the empty disk. I use the normal dd command because these disks are fully functional
    dd if=/dev/sdc of=/dev/sdb bs=512 count=6000640 status=progress
  9. Format the swap partition of the empty samsung disk (sdb2) and delete sdb3. Re-create sdb3 to fill the whole disk:
    root@milkyway:~# mkswap /dev/sdb2
    root@milkyway:~# fdisk /dev/sdb
    delete partition 3 (fdisk command d), re-created it as new partition and then write the partition table.
    Make an empty filesystem on sdb3:
    root@milkyway:~# mkfs.ext4 /dev/sdb3
  10. Copy now the content (not the partition) of sdc3 (samsung disk with recovered data) into sdb3 (samsung disk with big 3rd partition but no data). Create two mount points to do the copying.
    mkdir /tmp/mntsdb3
    mkdir /tmp/mntsdc3
    mount /dev/sdb3 /tmp/mntsdb3
    mount /dev/sdc3 /tmp/mntsdc3
    cd /tmp/mntsdc3
    find . | cpio -V -dump /tmp/mntsdb3
    cd
    umount /dev/sdb3 /tmp/mntsdb3
    umount /dev/sdc3 /tmp/mntsdc3
  11. Now we have two usable samsung disks. The first one is just a raw copy of the original intel disk and the second one is also a copy but has a much bigger 3rd partition (=root partition in this case). We can't plug it like that into the computer because the partition id has changed due to the hardware change. The kernel will boot but it will not find the root partition. Use the command "blkid" to find the new blkid of the root partition (mount sdb3 and run comand blkid). Note the long uuid number down. It will be something like UUID=797f952d-6465-4e42-9f8b-f5fb97857048
  12. Install the "big samsung disk" in the labtop and boot. Wait for the GRUB menu to show (if you don't see a GRUB menu, press and hold the Left Shift key right after starting the system). Now highlight the kernel you want to use, and press the e key. You should be able to see and edit the commands associated with the highlighted kernel. Go down to the line starting with linux and edit the command parameters. Look for a parameter called root (for root partition) and write:
    root=UUID=797f952d-6465-4e42-9f8b-f5fb97857048
    Now press Ctrl+x to boot.
  13. The computer should boot properly. Become root and edit /etc/fstab (vi /etc/fstab). Replace the uuid of the old root partition (from intel disk) with the uuid of the new one (samsung disk). Something like
    UUID=797f952d-6465-4e42-9f8b-f5fb97857048 / ext4 errors=remount-ro 0 1
  14. Re-write the boot sector:
    update-grub
  15. reboot the computer and now it should boot without the need to do any editing in the grub menu. The computer is fully restored with all the data and you have a bigger disk partition with more extra space.


Conclusion: Buy only original samsung disks made in korea. Intel can no longer be trusted and I am also avoiding made in china samsung disks. Note that there are some fake SSDs out there. Fake disks have often poor quality stickers and the disk serial number on the sticker may be different from the serial number read via smartctl -a. If you want to save money and avoid fake disks then buy used server ssd disks.

It seems that the ssd error correction algorithm can recover some data when damaged blocks are read a second time with ddrescue.


Back to NPA blog index

© 2004-2025 Guido Socher