Please help me settle an argument with a coworker.

[Michael.Reilly]

I'm currently engaged with an argument with a coworker over which method is more wise. I'm not going to reveal which side I am on and attempt to describe the issue as evenhandedly as possible.

The argument is over which is more damaging to a drive.

Scenario:
A drive is diagnosed as being unable to mount in Windows but will copy data under Linux. The drive copies and begins to IO. Technician does not notice the drive has IO'd until the copy is finished and he is QCing the drive to make sure all the data reached the destination. There are several files missing.

Technician A wants to use ddrescue to image the drive.
Technician B wants to use ddrescue to copy only the files that the terminal copy missed.

Verbatim arguments (have been cleaned up for grammar and spelling to make it more difficult to determine which I am.)

The script in question is:

Code:

IFS=$(echo -ne “\n\b”);
for file in \
$(\
diff \
<(find /media/source/ -type f | sed ‘s|^/media/source/||’ | sort) \
<(find /media/destination/ -type f | sed ‘s|^/media/destination/||’ | sort) | \
grep ‘^<’ | cut -c3-);
do ddrescue -dvr10 \
/media/source/”$file” \
/media/destination/$(sed ‘s/[^a-zA-Z0-9 .]//g’ <(printf %q $file));
done

Technician A's argument is:

There could be some MFT entries themselves for files in I/O areas. These files will be skipped and I don't think your script accounts for that. Also, in the case of fragmented files, instead of a full DD which images smoothly, this script could jump 100+ different places for these files, potentially damaging the platters and making previously recoverable data unrecoverable.

Technician B's argument is:

You're arguing that the script will hammer the drive, but the script touches the drive far less than a ddrescue would, in terms of time, sectors and seeks. ddrescue images the entire drive, rather than just the parts that need to be imaged. And file fragmentation is far more rare than you're implying. Even so we both know it's better for a disk to read 50MB is 10 locations than it is to read 320GB.

Thank you for your time.

[quasimodo]

Although I am personally not a big fan of ddresuce, I would more so agree with Technician A. IMO it would be better to image the entire drive. mainly because the grep search will add stress to the drive, now if you really would want to make the script great and efficient, rather then doing a grep search, write some code to read directly from the MFT. Then you can tell ddresuce to only copy the sectors required.

[Michael.Reilly]

As a bit of clarification, both technicians want to run ddrescue. Tech A on the entire drive, Tech B using the filesystem grep.

[drc]

Either way could be stressful and should not be performed unattended if you are concerned about it. Like quasi said, a better way to handle it would be to analyze the MFT yourself and find specifically which sectors you need to get

[lcoughey]

If A or B, I'd certainly go with A. But, my preferred route would be to use DDI or DE to scan the MFT and determine if we can just target the specific sectors with as little stress as possible.

[Michael.Reilly]

So it seems that the consensus is there's a better way, but of the two A's method of imaging the entire drive is better than B's method.

Unfortunately, I seem to be B in this case.

Ah well, thank you so much for your help in this matter.