Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a 100GB NTFS-formatted drive, and a 250GB external USb disk.

I am thinking of using a live disk, as is described here, except that I will skip the gzip part.

I have enough space. I just want to back up EVERYTHING (including recoverable deleted files) for forensic purposes. That is why gzip is more of a nuisance in this case (I think).

Anyhow, if I use this command:

sudo dd if=/dev/hd_ > /mnt/hd__/image_name.dd

Will this save EVERYTHING, or just the healthy and existing directory structure?

Also, what is the easiest way to mount that image later on: A) Mac OS Leopard B) Windows XP / Vista / 7?

Free versions of software are preferred, but I will consider shelling out some $ if the product is amazing.

Thank you and Happy New Year!

share|improve this question
Make sure the USB disk is not formated as FAT32 - FAT32 has a 4GB file size limit. – Macha Jan 1 '10 at 18:27
I just bought it ... not sure which partition is on it yet. Can Linux write to NTFS partition reliably? I remember a few years back NTFS had read-only support. Since I will be giving the disk to a (mot likely) Windows user, I want to make it easy for them or else I will have to pay extra. – Fantomas Jan 1 '10 at 18:33
Yes, the dd command copies everything. If you image a harddrive using it, it saves every file, as well as boot flags and partition structure. – Zurahn Jan 1 '10 at 18:36
up vote 2 down vote accepted

dd is the best way to do this. While the method you posted will technically work (which not output file is specified, dd sends the output to shell). It would be better, as Wil says, to use sudo dd if=/dev/hdX of=/dev/hdY Not that the disks could also show up as /dev/sdX. If you're not sure which disk is which, type sudo fdisk /dev/hdX, and press p to print the partition table for that device.

dd does a bit-by-bit copy, it produces a forensically sound image, so any recoverable files will be there.

One of the best tools to mount the image on Windows that I've found is WinHex, it lets you browse as a normal disk, and has some data recovery features. However, GetDataBack (NTFS) has much better recovery, and it can also access image files.

share|improve this answer
Thanks ... if only I had 15 reputation, I would vote up myself. For clarification: when I use the of option, can I send the output to a file on a partition (USB ext disk) and not to the partition itself (if that makes sense)? – Fantomas Jan 1 '10 at 18:23
If you mount the USB disk, then you can send the output there. sudo if=/dev/hdX of=/mnt/usb/disk.img would work fine. – Dentrasi Jan 1 '10 at 20:50

I would recommend the easiest thing you can do is simply to use Gparted, and do copy from the original partition and paste it to the USB drive.

When you click apply, it should do a 1:1 copy and work fine!

However, to your original question, I am not an expert using dd, but I would have thought you need...

sudo dd if=/dev/hd_ of=/mnt/hd__/image_name.dd

share|improve this answer
Thanks ... will Gparted preserve deleted but recoverable files if any? Any info on mounting the partition under Windows? – Fantomas Jan 1 '10 at 17:50
OK... I understand what you want to do now - You want a sector by sector copy - I am really sorry, I have used gparted hundreds of times, but not for what you want - I know it works well, but I have never tested it for what you want. For this sort of thing, I use r-studio and create a sector level backup from there.... I think DD may do what you want then. – William Hilsum Jan 1 '10 at 18:03

if you want to preserve the drive content for further forensic examination, i recommend EASEUS Disk Copy, a potent freeware providing sector-by-sector disk/partition clone regardless of your operating system.

and speaking of forensics, there's nothing better than WinHex, a 1 year personal license is pretty reasonable too (€39.41).

since it is a NTFS partition, there's no reason why you shouldn't be able to mount it in Windows, however, i would not recommend it, because Windows my write information to the drive which may make forensic examination even harder, use WinHex from a BartPE CD/USB stick instead to avoid any writing.

share|improve this answer
Thank you, good to know. I sort of know my way around Linux, so I do not mind booting up with a Live CD - seems like a safer option a well, knowing that I can mount the source drive as read-only. – Fantomas Jan 1 '10 at 18:26

I'm a bit surprised that nobody mentioned CloneZilla -- what doesn't it do that the OP needs?

share|improve this answer
you wouldn't need Clonezilla, as sector copy in Clonezilla is done by DD anyway. – Molly7244 Jan 1 '10 at 19:24

I'd note there's forensics specific livecds such as deft, and forensic DD varients such as DFCLDD. Don't forget to do checksums too. As far as methods go, there's a good book by mandia and procise i believe that covers most of the process.

os x should mount images with the loop command. Windows needs additional software- filedisk comes to mind, but there's probably easier alternatives

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .