dd_rescue

dd_rescue is designed for recovering data from crashed or damaged disks where standard tools like cp, cat, and dd fail by aborting on errors. It continues copying despite I/O issues, optimizing with large blocks when possible and falling back to smaller ones on errors. This makes it ideal for forensic data extraction from unreliable media.

Key use cases include disk imaging for data recovery, approaching bad sectors from multiple directions, sparse copying, and preallocating space. It bypasses kernel pagecache with O_DIRECT and supports splice zerocopy for efficiency. Additionally, it provides data protection through multiple overwrite passes with random numbers.

With plugins like ddr_hash, it can compute hashes such as SHA256 or HMAC during copying. The tool handles files, devices, or pipes as input/output, making it versatile for partitions and full disks in cybersecurity and forensics workflows.

dd_rescue uses adaptive block sizes: large softbs (default 131072 bytes) for error-free areas, falling back to hardbs (default 4096 bytes) on errors. It supports reverse copying to approach bad spots, sparse file handling, and direct I/O to skip pagecache. For secure deletion, it generates pseudo-random data via PRNG from seeds, /dev/urandom, or frandom, applying 1-4 passes (e.g., random, inverse random, zero). Progress tracking shows ipos/opos, transfer rates, errors, and ETA. Features like O_DIRECT, splice, fallocate, and plugins for hashing/compression enhance performance and integrity.