Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have an ext. drive with a corrupted NTFS (in the sense that NTFS-3G refuses to mount it).
I really want to just take an image of the drive, stash that somewhere for later, and reformat the drive so I can use it normally. I don't want to lose any of my files on the drive.
Question: Is there a way to take an (compressed?) image of the drive that will preserve it bit-for-bit and allow me to do forensics later?
Just copying the device someplace should work:
dd if=/dev/whatever of=/some/file/to/save
The default blocksize (bs=...) flag should be fine, in any case setting it wrong will at most make it slow down.
If the filesystem might be broken due to hardware problems, experiment with other filesystems first, and make sure the bs is a multiple of the hardware block size. When disks start behaving erratically, they usually have at most hours of life left in them.
You should be able to use raw to bind the partition's block device to a raw character device and then use dd to read the partition image. Make sure that bs is the actual sector size of the disk, or some multiple thereof. (The default should work, I believe.)
