Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've picked up an HP Simplesave external drive. It comes with some fancy software that is of no use to me because I don't use Windows. Like many current consumer-targeted backup drives, the backup software is actually contained on the drive itself. I'd like to save the drive's initial state so that I can restore it if I decide to sell it.

The backup box itself is somewhat customized: in addition to the hard drive device, it presents a CDROM-like device on /dev/sr0. I gather that the purpose of this cdrom device is to bootstrap via Windows autoplay the backup application which lives on the disk itself. I wouldn't suppose any guarantees about how it does this, so it seems important to preserve the exact state of the disk.

The drive is formatted with a single 500GB NTFS partition.

My initial thought was to use dd to dump the disk (/dev/sdb) itself, but this proved impractical, as the resulting file was not sparse. This seemed to be because the NTFS empty space is not filled with zeroes, but with a repeating series of 16 bytes.

I tried gzipping the output of dd. This reduced to the file to a manageable size — the first 18GB was compressed to 81MB, versus 47MB to tarball the contents of the mounted filesystem — but it was very slow on my admittedly somewhat derelict Pentium M processor. The time to do that first 18GB was about 30 minutes.

So I've resorted to dumping the disk state and partition data separately.

  • I've dumped the partition state with

    sfdisk -d /dev/sdb > sfdisk.-d.out
    
  • I've also created a compressed image of the NTFS partition (the only one on the disk) with

    ntfsclone --save-image --output - /dev/sdb1 | gzip -c > ntfsclone.img.gz
    

Is there anything else I should do to ensure that I can restore the precise original state of the drive?

share|improve this question
    
cross-posted on unix and linux –  intuited Jan 1 '11 at 18:39
add comment

1 Answer

Your initial dd+gzip setup is your best bet. In fact, 'dd' is considered by some forensic experts the only tool capable of making a bit-by-bit copy of a disk. Of course, you can create the copy on a faster computer, no need to make it on the computer you will be using the disk with.

share|improve this answer
    
Hmm.. good to know. Any ideas on a better tool for compression? At that rate the compressed image will end up being over 600MB for something that's basically 99.9% zeroes. –  intuited Jan 3 '11 at 5:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.