Working without a clone - is it safe?

Changing something on a drive without having a clone (or a disk image file) is risky. Even not changing things is still risky. You should always make a clone (or a disk image file) before working on the recovery.

What's a clone?

A clone is an exact copy of a entire (faulty) drive on another (good) drive. A disk image file is the exact copy of entire (faulty) drive in a file. The copy contains all sectors on the original drive, including blank sectors and sectors which are presumed not in use.

Why is it needed?

Standard practice is to make a clone of the damaged dirve (or any device, really) immediately as it comes in for recovery, just in case. There are cases when recovery can arguably performed without making a clone, but the decisions like this are best left to specialists. They have the experience, and they do their clones anyway.

A reasonable argument can be made that running TestDisk and modifying partition tables is safe if the original partition tables are damaged. Afterall, if TestDisk screws up and overwrites original unusable partition table with a new unusable partition table, things are not getting any worse – the original was unusable anyway. This argument only works if the damage is limited to the partition table, and there is often no way to know it is. It is quite possible that TestDisk will rebuild the partition table properly and then on the next reboot the filesystem driver will try to mount the filesystem only to discover that filesystem is also damaged. The driver then can happily thrash the filesystem during some kind of repair attempt or even during routine initialization, depending on the specific damage.

The same argument applies to running recoveries on a mounted drive (or a memory card). A mounted drive is the drive which has a drive letter assigned to it, and is generally accessible via File Explorer or whatever other "normal" means. Even though you are not accessing the drive explicitly, the filesystem driver still does its things and might in some cases adversely affect the data. If you do not command or do not see changes being made, it does not mean no changes are being made to the drive.

However rare, these things do happen, and it is then when you need a clone.

Created Sunday, January 20, 2019

I have a low volume mailing list, for news and tips, which I send out once or twice a month.
Subscribe if you are interested.