These are two great utilities for imaging a drive, dc3dd is dd but upgraded for forensic use allowing you to take hashes and split an image all from one command. ddrescue is a utility that allows you to image a drive but is sensitive to bad sectors and will take precautions as to not damage the drive any further. The main difference is that dc3dd (and dd as well) will read the drive from top to bottom attempting to read all sectors even if they are bad which could cause more damage and it will stop (unless told to) when it can't read a sector.ddrescue will go through the drive and mark bad sectors and skip them at first and once it has copied all the good sectors, come back and try to read the bad sectors writing zeros if it can't read them. Another big difference is that ddrescue can resume an image job if canceled and dc3dd/dd can't.
dc3dd
Example: dc3dd if=/dev/sda of=image.dd progress=on hash=md5 split=64 splitformat=000 iflag=direct log=image.log
Switches:
progress - Will show progress on screen
hash - Will make a hash value of the image, md5 in this example
split - Will split the image into x size portions, 64MB parts in here
splitformat - Will append a number or letter at the end of each part, ie image.dd.001,image.dd.002, etc...
iflag - Will skip kernel cashing. Used for more precise log information.
log - Write a log file, image.log in this example
Extra Switche:
conv=noerror,sync
conv - Will tell dc3dd to ignore errors and continue reading
sync - Will synchronize the drives so they are identical with zeros where there are bad sectors
This two options are not recommended because they can be destructive and further damage the drive before you are able to get all the good sectors. If the drive is damaged or has bad sectors, use ddrescue.
ddrescue
Example1: ddrescue -d -n /dev/sda image.dd image.log
In here the -n switch tells ddrescue to only write the good sectors and stop. The -d switch tells it to skip kernel caching for a more exact report of sectors read. If you interrupt the command you can issue the same command with the same log file and it will continue where it left off. The log file keeps track of good/bad sectors and where to continue if it needs to.
Example2: ddrescue -d -r3 /dev/sda image.dd image.log
In the second example we resume our image copy and will read the bad sectors 3 times (-r3switch) and write zeros if it can't read them.
One other note, the values displayed in the log are in hex, to see them in decimal use bc. Ignore the 0x part.
Example: echo "ibase=16;12345678" | bc