How do I read a damaged disk with dd?Note that besides dd, there is a few more methods to read a damaged disk.
Windows users, see the other dd for Windows article.
For Mac users, there is a good technique to create a disk image from the damaged disk or card, which is the first step towards recovery of footage.
In a nutshell, we use a small utility called dd that is able to read the raw data of a disk. (From now on, we will just use the word disk, and it can refer to a hard disk, a memory card or a USB drive)
Under the premise that the disk is readable, i.e. the Finder detects it when you plug the disk or insert the card in the reader, the disk icon shows up under Devices in the left column of Finder windows, dd should be able to create a file with about the size of the disk. (If the disk is not readable, you may want to re-evaluate the situation)
Here is the process, step by step:
1. Connect the damaged disk to the computer. Your Mac must detect it, otherwise the technique doesn't work.
2. Open a Terminal window (i.e. launch the program called Terminal in /Applications/Utilities/) and type the command:
It will display something like this. Don't be afraid!
Filesystem 1M-blocks Used Available Capacity Mounted on /dev/disk0s2 257920 167480 90190 65% / devfs 0 0 0 100% /dev /dev/disk0s3 15237 4361 10875 29% /Volumes/NO NAME map -hosts 0 0 0 100% /net map auto_home 0 0 0 100% /home afp_3QOi4046HFGT3JO0zJ2yRHzR-1.2e00000c 125190 55041 70148 44% /Volumes/bjoossen afp_3QOi4046HFGT3JO0zJ2yRHzR-2.2e00000d 476939 196736 280203 42% /Volumes/Store afp_3QOi4046HFGT3JO0zJ2yRHzR-3.2e00000e 125190 55041 70148 44% /Volumes/serverHD
It is just a list of the devices connected to your computer.
Here the interesting device is /dev/disk0s3 : this is the disk that we want to recover. You should always pick one of the names in the first column that begins with /dev/disk. Take note also of the size of the disk, the value in the second column: 15237 MB, or around 15 GB.
3. Verify that you have enough space available on your hard disk.
The rule of the thumb is that a 15 GB disk will produce a 15 GB file, a 120 GB hard disk will need 120 GB and so on.
4. Type the command below
Of course, you will replace this disk name by the disk name that you have noted from df -m output.
dd if=/dev/disk0s3 of=/fromDisk.img conv=noerror,sync
This command creates a file called fromDisk.img in the root folder, that is a carbon-copy of the damaged disk.
The operation can take a long time. For 1 GB, it can take one minute or more. For 120 GB, it will take several hours.
Note that you can monitor the size of the fromDisk.img file as it grows from 0 to the size of the disk: It will give you an idea of the progress.
What do I do with the .img file?
Now if everything went fine, you should have a .img with a size similar to the disk capacity.
If the disk still contains footage, the footage must now be inside this file also, and we can do a diagnostic of the file and hopefully, repair it.