How to create an accurate byte-level copy of an SSD to another drive

data transferdata-recoveryhard drive

TL;DR I need to recover lost files from an SSD but don't have the time to do it right now. How can I clone an SSD to another drive on byte level, including drive areas which the OS thinks are free?

I did a cut and paste (Comd+C then Comd+Opt+V) on my Mac 10.14’s Finder to move some .mov files from my internal SSD to my WD My Passport External Harddrive (connected by USB 3.0 with a USB-C to USB adapter. My 15-inch Macbook is the 2018 version which only has USB-C ports, and has the touch bar).

Alas, after a while, I move my Macbook and the connected got unstable, and was eventually lost. To my horror, when I tried to do a transfer again, I see that some files are greyed out on my external WD harddrive (see screenshot), and these files are no more on the original folder on my internal SSD!

I tried to recover these files by using the following software on my SSD (**but not on the external hard drive yet) to no avail:
Disk Drill
File Salvage
EaseUS Data Recovery
Techtool Pro 11

**I ran the software immediately after discovering the issue, because I know that if I continued using the Macbook, there would be risk that the OS would overwrite my files.

Can someone tell me:

(a) I am so tired of doing all this recovery, and want to move on to something else. But I need to use my Macbook! If I use it, I will definitely overwrite the lost files’ bytes one day. Can I do a byte-for-byte clone of the SSD to somewhere and work on this recovery issue some other time?

(b) If yes, what software should I use and how do I make sure that the clone is both byte-for-byte AND it includes the parts of the SSD that are now seen by the OS as “free” (since that’s probably where the lost files reside?)

(c) For (b), prefer software that can also show me the bytes in hexadecimal so I can inspect manually to see if it’s really byte for byte.

P.S.: For more context, see: Data loss due to lost connection when transferring from Mac 10.14 SSD to External HDD

P.S.: the SSD I am looking to clone is 256GB

Best Answer

My favorite tool for that is the "dd" command that comes with macOS. It needs to be used from the Terminal, so if that puts you off - there are also GUI alternatives.

"dd" is quite simple and will copy all data - including "free" areas. You take a clone by first rebooting your computer into Recovery mode.

Then mount an external drive where you want to store the backup - make sure it has enough free space to contain the full size of the original drive.

Open Disk Utility to find the device name of your original drive. This is probably something like /dev/disk1s1 or similar. Also, if your original drive has been mounted for some reason while in Recovery mode - unmount it from Disk Utility.

Then open Terminal and run a command like this:

dd if=/dev/rdisk1s1 of=/Volumes/ExternalDrive/clone.img bs=1m

Note that I put an "r" in front of disk1s1 - this bypasses buffers to make the transfer faster.

Also note that the output file name is specified as /Volumes/ExternalDrive/clone.img. You'll want to replace "ExternalDrive" with the name of your own externally connected drive.

The last part of the command bs=1m means to copy in block sizes of 1 megabyte. This just speeds up the operation.

Related Solutions

How much faster is an external SSD than external HDD if internal drive is SSD

In your case probably a upgrade to SATA 3 SSD (internal) would do the most.

AFIK your model supports it, and you will get up to 6 Gb/s R/W speeds and combined with RAM upgrade would get you what you want.

Adding a external drive to expand the storage if needed, the one would use the Thunderbolt SSD.

Find out if your Model supports the SATA 3 SSD before spending the money:

Open About this mac- more info- system report - SATA..

then you will see something like I have

SATA

My little MacBook Air rocks, it can run up to 6 Gb/s

How to make sector level copy of external hard drive with FileVault 2 enabled

At least Carbon Copy Cloner is just a wrapper for either dd or rsync. I suspect that it's the same with SuperDuper!.

Since both tools (of which rsync is not needed here) are already included in OS X you don't have to buy it.

To clone one drive to another you have to prepare the source and the target drive.

Most sizes and commands containing sizes, disk identifiers or paths etc. below are just examples. You have to replace them by respective values found in your set up/listings.

Mark the source drive with a red sticker, if the source and target drive have identical cases!
Attach both drive but don't mount the encrypted FileVault volume. If it is already mounted unmount it. Detach all other external drives.

Open Terminal and enter diskutil list to get an overview. You will get a list of all attached drives similar to this one - your output may slightly differ):

/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *121.3 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:          Apple_CoreStorage                         121.0 GB   disk0s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk0s3
/dev/disk1
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *3.0 TB     disk1
   1:                        EFI EFI                     209.7 MB   disk1s1
   2:          Apple_CoreStorage                         3.0 TB     disk1s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk1s3
/dev/disk2
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Macintosh HD           *3.1 TB     disk2
/dev/disk3
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *4.0 TB     disk3
   1:                        EFI EFI                     314.6 MB   disk3s1
   2:          Apple_CoreStorage Encrypted               4.0 TB     disk3s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk3s3
/dev/disk4
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *4.0 TB     disk4
   1:                        EFI EFI                     314.6 MB   disk4s1
   2:                  Apple_HFS Data                    4.0 TB     disk4s2

Now you have to analyze the output. Here disk0 and disk1 are a 3.1 TB Fusion drive with the CoreStorage volume mounted as disk2. Disk3 is obviously the encrypted disk with deleted data which should be cloned. Disk4 is a spare drive and the target of the clone task. Disk4 has to have at least the same size as disk3! Check this with diskutil info disk3 and diskutil info disk4.

Below I assume disk3 is the source and disk4 is the target of the clone task. Your disk identifiers may be different (e.g. disk2 and disk3)

Check the device block sizes with
```
diskutil info disk3 | grep "Device Block Size:"
diskutil info disk4 | grep "Device Block Size:"
```
Usually the Device Block Size of ≥4 TB drives is 4096 Bytes. If the block sizes of disk3 and 4 are equal you are fine.

Now get the partition tables of the external drives with sudo gpt -r show diskX. The output should be similar to the one below:

sudo gpt -r show disk3
      start       size  index  contents
          0          1         PMBR
          1          1         Pri GPT header
          2          4         Pri GPT table
          6      76800      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      76806  976636661      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC
  976713467      32768      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  976746235          4         Sec GPT table
  976746239          1         Sec GPT header
sudo gpt -r show disk4
      start       size  index  contents
          0          1         PMBR
          1          1         Pri GPT header
          2          4         Pri GPT table
          6      76800      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      76806  976636711      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  976713517      32768         
  976746285          4         Sec GPT table
  976746289          1         Sec GPT header

Start and size values are block numbers or blocks. Block numbering starts at block 0! In my example disk4 is slightly bigger (50 blocks) than disk3.

First you have to create identical "mirror" partition entries on disk4 (with the same values as those on disk3).
Unmount the target drive:
```
diskutil umountDisk disk4
```
Destroy and recreate the GUID partition table (and/or remove an MBR partition table) of the target drive:
```
sudo gpt destroy disk4
sudo gpt create -f disk4
```

get an overview of disk4 with sudo gpt -r show disk4. It should look like this:

      start       size  index  contents
          0          1         PMBR
          1          1         Pri GPT header
          2          4         Pri GPT table
          6  976746279
  976746285          4         Sec GPT table
  976746289          1         Sec GPT header

Now recreate the first two partitions of disk 3 with the values of disk3 on disk4:
```
sudo gpt add -i 1 -b 6 -s 76800 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B disk4
sudo gpt add -i 2 -b 76806 -s 976636661 -t 53746F72-6167-11AA-AA11-00306543ECAC disk4
```
This will only modify the GUID partition table (the first 6 and the last 5 blocks) of disk4.

Recheck the partition table of disk4 with sudo gpt -r show disk4. It should look like this now:

      start       size  index  contents
          0          1         PMBR
          1          1         Pri GPT header
          2          4         Pri GPT table
          6      76800      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      76806  976636661      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC
  976713467      32818         
  976746285          4         Sec GPT table
  976746289          1         Sec GPT header

Now clone the content of disk3s1 and disk3s2 to disk4s1 and disk4s2:
```
sudo dd if=/dev/disk3s1 of=/dev/disk4s1 bs=1m
sudo dd if=/dev/disk3s2 of=/dev/disk4s2 bs=1m
```
Clone disk3s3 to a file:
```
sudo dd if=/dev/disk3s3 of=/Users/user_name/Desktop/bootosx.cdr bs=1m
```
Replace user_name by your short user name.

Cloning the first partition (300 MiB) is fast (~3.5 seconds). Cloning the second partition (4 TB) will take about 11 hours (USB3/Thunderbolt) or 30-50 hours (USB2).
Unmount the source drive:
```
diskutil umountDisk disk3
```
and detach it. Check if the target drive still is disk4: diskutil list.

add the third partition on disk4:

sudo gpt add -i 3 -b 976713467 -s 32768 -t 426F6F74-0000-11AA-AA11-00306543ECAC disk4

Clone bootosx.cdr to disk4s3:

sudo dd if=/Users/user_name/Desktop/bootosx.cdr of=/dev/disk4s3 bs=1m

After the cloning to the last partition on the target disk is done, you should be asked for the FileVault password.
Don't attach the source and the target drive at the same time on one Mac. They have identical UUIDS for the LVG/PV/LVF/LV (the CoreStorage Volume Group containing the FileVault container) and I don't know if and how they "coexist".

Adaption to the actual set up of the OP

The target disk (disk3) has a different Device Block Size (512 Byte). The source disk has several FileFault2 volumes.

Under these circumstances some partition table values of the target disk (disk3) have to be adjusted and only one of the CoreStorage partitions has to be cloned with dd.

Unmount the target drive:
```
diskutil umountDisk disk3
```
Destroy and recreate the GUID partition table (and/or remove an MBR partition table) of the target drive:
```
sudo gpt destroy disk3
sudo gpt create -f disk3
```

get an overview of disk3 with sudo gpt -r show disk3. It should look like this:

       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34  7814037101         
  7814037135          32         Sec GPT table
  7814037167           1         Sec GPT header

Now recreate the first and the sixth partition of disk 6 with modified values on disk3. Since the Device Block Sizes of the two disks are different you have to recalculate start blocks and sizes (usually by multiplying with 8):
```
sudo gpt add -i 1 -b 40 -s 614400 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B disk3
sudo gpt add -i 2 -b 614440 -s 4882550376 -t 53746F72-6167-11AA-AA11-00306543ECAC disk3
```
This will only modify the GUID partition table of disk3.

Recheck the partition table of disk3 with sudo gpt -r show disk3. It should look like this now:

       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34          40
          40      614400      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      614440  4882550376      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC         
  4883164816  2930872319
  7814037135          32         Sec GPT table
  7814037167           1         Sec GPT header

Now clone the content of disk6s1 and disk6s6 to disk3s1 and disk3s2:
```
sudo dd if=/dev/disk6s1 of=/dev/disk3s1 bs=1m
sudo dd if=/dev/disk6s6 of=/dev/disk3s2 bs=1m
```
Clone disk6s7 to a file:
```
sudo dd if=/dev/disk6s7 of=/Users/user_name/Desktop/bootosx.cdr bs=1m
```
Replace user_name by your short user name.

Cloning the first partition (300 MiB) is fast (~3.5 seconds). Cloning the FileVault partition (2.5 TB) will take about 7 hours (USB3/Thunderbolt) or 20-35 hours (USB2).
Unmount the source drive:
```
diskutil umountDisk disk6
```
and detach it. Check if the target drive still is disk3: diskutil list.

add the third partition on disk3:

sudo gpt add -i 3 -b 4883164816 -s 262144 -t 426F6F74-0000-11AA-AA11-00306543ECAC disk3

Clone bootosx.cdr to disk3s3:

sudo dd if=/Users/user_name/Desktop/bootosx.cdr of=/dev/disk3s3 bs=1m

After the cloning to the last partition on the target disk is done, you should be asked for the FileVault password.
If you don't get a password prompt, you can mount it by entering diskutil cs list and diskutil cs unlockVolume LVUUID (with LVUUID: UUID of the encrypted CoreStorage volume - in your case probably BE5B9EBC-6DCB-49C5-B055-B00C49864795)

Please add a comment (with @klanomath) if you don't get a password prompt or run into problems.

Best Answer

Related Solutions

How much faster is an external SSD than external HDD if internal drive is SSD

How to make sector level copy of external hard drive with FileVault 2 enabled

Related Question