Re: [Bug-ddrescue] Can i obtain a "valid copy" using ddrescue ?

[Matt Ruffalo]

Hi Federico-

Your question suggests some minor confusion about the operation of
ddrescue and disk cloning in general, which is worth clarifying. The
"last access" time that you mentioned is a property of files and
directories in a specific filesystem, and ddrescue is not meant to be
used to copy the *files* from a disk¹. The normal usage of ddrescue is
to copy an entire disk, byte for byte, to another disk or to a large
file in some other filesystem. This includes the partition table, the
boot sector, the contents of each partition, etc., and is completely
agnostic of what data or filesystem(s) that disk may contain.

If the disk contains one or more partitions and filesystems, it is
rather important that these filesystems *not* be mounted while copying
the disk with ddrescue. Mounting a disk asks the kernel "please
interpret the contents of this device (disk or partition) as a
filesystem, and make it available somewhere in the existing filesystem
hierarchy or (in the case of Windows) as a drive letter". This operation
is what could modify the contents of the disk -- and this is what you
should *not* do in the context of cloning a disk with ddrescue. At this
stage of data recovery or cloning, you should avoid interpreting the
contents of the disk at all costs -- treat the disk as a "raw" sequence
of bytes, and copy that sequence of bytes to somewhere else without
caring what those bytes contain.

So the initial answer to your question is: yes, ddrescue can obtain what
you call a "valid copy" that is byte-for-byte identical to what's on the
disk, without any modification of the original contents or the new copy.

However, I am curious about your motivation and your reasons for asking
this question. While it is true that ddrescue does not modify the source
data in any way, one cannot run ddrescue in isolation, and other
processes or software may attempt to automatically mount a filesystem.
Some Linux live CDs, for example, may search all available
devices/partitions while booting (usually in the initrd), to find the
rest of the data required to run the full operating system. Even if all
such filesystems are mounted read-only, it is possible that some
filesystem drivers may alter the contents of the disk for things like
replaying a journal or other things along those lines.

If a "valid copy" matters very much to you for forensic recovery (or
something like that), you will likely need specialized equipment: a
hardware write blocker which will ensure that *nothing* on the disk is
modified. I know nothing about Italian laws and requirements for
forensic data recovery, but in America I am under the impression that
any potential modification of a disk's contents can make the entire disk
inadmissible as evidence. If this matters to you I would advise you to
contact a qualified lawyer instead of this mailing list.

--------
¹ ddrescue *can* be used to copy single files, of course, and in fact I
use it reasonably often for this. The speed/progress display is nice,
and I like how easy it is to stop/resume the copy operation if I use a
log file. The fundamental operation of ddrescue is still to copy one
file to another file (and of course disks and partitions are visible as
files on Linux and Unix systems).

MMR...

On 2015-11-12 11:41, Federico Mambelli wrote:
> Hi to everyone!
> I am interested in your project but only (for now) as disk copier.
> To be honest, at the moment, i didn’t try ddrescue becouse i am still want to 
> understand what i really need.
> For first, i need to understand if ddrescue can provide me an authentic copy 
> of the original and in which way.
> Then, i would like to understand if ddrescue edit, in any way, the original 
> data like editing the “last access” parameter or what else!
> I am sorry if my question seems to be silly or inappropriate but i am not an 
> expert in computer scienze!
> I am really sorry for my bad english so i copy the original text, maybe you 
> have some italians in team!
>
> Ciao a tutti quelli del supporto di Ddrescue.
> Sono interessato nel vostro progetto ma semplicemente ( e per ora ) come 
> clonatore di hard disk.
> Onestamente, non ho ancora avuto modo di provarlo perché sto ancora cercando 
> di capire che cosa necessito.
> Per prima cosa, mi servirebbe sapere se ddrescue può fornirmi una copia 
> autentica, conforme e uguale all’originale e in che modo?
> Dopodichè vorrei capire se ddrescue altera in un qualsiasi modo l’originale, 
> magari cambiando il parametro “ultimo accesso”.
> Non sono un esperto in questo campo e magare le mie domande possono sembrare 
> stupide ma ho bisogno di capirci qualcosa!
> Grazie a tutti per qualsiasi risposta, proverò ddrescue con le mie mani il 
> prima possibile!
>
> Best regards, Federico!
> Inviato da Posta per Windows 10
> _______________________________________________
> Bug-ddrescue mailing list
> address@hidden
> https://lists.gnu.org/mailman/listinfo/bug-ddrescue