Windows – Using dd to image a corrupted Windows disk

disk-imagehard driventfswindows

What is the proper way to use dd (or anything else – asr?) to create an image of a corrupted yet readable Windows disk?

If what I am using (see below) is correct, then is it possible that an image of a disk would not be mountable when the original disk is?

Background info:

The disk's file system is not readable on a Windows system: the disk shows up as "raw" in disk management. It is however readable in macOS (10.14) and I am able to copy individual files from it.

The goal however is to copy the entire disk if possible to a readable image and then work with that image (repair partition table, recover remaining files) rather than with the failing disk that I am afraid can quit at any moment.

Here is the command I've been using to image a 500GB Windows disk that came from a Dell computer and that has a number of bad blocks and apparently a corrupted partition table:

sudo dd if=/dev/rdisk3 of=/Volumes/exFAT_Vol/rdiskX.dmg bs=4M conv=noerror,sync

Copies fast (40MB/s via USB 2.0) but doesn't seem to create a correct (mountable) image: "no mountable file systems" when trying to mount it in Finder.

Some sources (e.g. Recover a dead hard drive using dd from 2005) suggest using bs=512 and it's in progress now – yet copies at around 4MB/s which will take more than a day to complete – and I am not even sure it'll work.

Some of the relevant info on the disk and its partitions:

Volume type : Physical Device
BSD device node : disk3
Connection : USB
Device tree path : IODeviceTree:/PCI0@0/XHC1@14
Writable : No
Is case-sensitive : No
Volume capacity : 500,107,862,016
Available space (Purgeable + Free) : 0
Purgeable space : 0
Free space : 0
Used space : 500,107,862,016
Owners enabled : No
Is encrypted : No
Can be verified : No
Can be repaired : No
Bootable : No
Journaled : No
Disk number : 3
Media name : Generic External Media
Media type : Generic
Ejectable : Yes
Solid state : No
S.M.A.R.T. status : Not Supported

Volume type : Physical Volume
BSD device node : disk3s2
Mount point : /Volumes/Untitled
File system : Windows NT File System (NTFS)
Connection : USB
Device tree path : IODeviceTree:/PCI0@0/XHC1@14
Writable : No
Is case-sensitive : No
File system UUID : AC8CB496-EAD2-47A2-BB36-2A981976BC2B
Volume capacity : 500,064,122,880
Available space (Purgeable + Free) : 373,903,597,568
Purgeable space : 0
Free space : 373,903,597,568
Used space : 126,160,525,312
File count : 176,730
Owners enabled : No
Is encrypted : No
System Integrity Protection supported : No
Can be verified : No
Can be repaired : No
Bootable : No
Journaled : No
Disk number : 3
Partition number : 2
Media name : 
Media type : Generic
Ejectable : Yes
Solid state : No
S.M.A.R.T. status : Not Supported
Parent disks : disk3

Best Answer

Based on what I've done so far and the comments I've read on "Recover a dead hard drive using dd":

  • dd fails to image or clone damaged media to make the result equally mountable or readable, in multiple instances including mine;
  • there isn't an alternate tool in stock macOS that can do that.

In more detail:

  • The command I've been using in the question is the "proper" way - yet in many instances of working with damaged media, it does not create an image that like the original one, can be mounted and read. Basically, it fails at its task.
  • There isn't an alternative within stock macOS (such as ASR) that can clone or image damaged yet readable media. ASR (or its GUI sibling, Disk Utility) will bail out once there is an I/O error such as bad blocks on the media.
  • Haven't tried other tools that aren't part of macOS (such as ddrescue or dd_rescue mentioned in the linked article) - my answer is only about tools that are part of stock macOS.

The answer is based on multiple comments in "Recover a dead hard drive using dd" that mirror my experience: dd completes yet the image can't be mounted. I.e. dd does not appear to have created a close enough image of the media.

Here is what I have tried:

  • Use sudo dd if=/dev/rdiskX of=/Volumes/exFAT_Vol/image.dmg bs=4M conv=noerror,sync and sudo dd if=/dev/rdiskXsY of=/Volumes/exFAT_Vol/image.dmg bs=4M conv=noerror,sync to image the media. Neither image can be mounted, with errors such as "the following disks couldn't be opened: no mountable file systems".
  • Use the resultant image to restore to a (healthy) physical media via sudo dd if=/Volumes/exFAT_Vol/image.dmg of=/dev/rdiskZ bs=4M conv=noerror,sync - with a similar result: the physical media can't be mounted, and unlike the original damaged one, doesn't display the partition information such as "File system : Windows NT File System (NTFS)".
  • Attempt to use "First Aid" in "Disk Utility" to repair the images or the clones. None worked, with error messages such as:
    • Fixing damaged partition map. The operation couldn’t be completed. (com.apple.DiskManagement error -69874.) Operation failed….

What I haven't yet tried:

  • Use dd with a different bs= value such as 512, instead of 4m. Takes too long.
  • Use dd without the conv=sync option, i.e. just use conv=noerror one. (Just didn't have a chance to try it yet - each attempt takes 4-5 hours.)
  • use dd with conventional rather than raw devices - e.g. /dev/disk4 rather than /dev/rdisk4.
  • Cloning directly from the damaged media to a healthy physical one, bypassing the imaging stage.
  • Any other tools besides dd, Disk Utility, asr.

Hope this helps someone else in the same situation and really hope my answer is wrong: i.e. hope that there is a way to make dd work in this situation, to make mountable images off damaged yet readable / mountable media.

Related Question