I have an ext. drive with a corrupted NTFS (in the sense that NTFS-3G refuses to mount it).

I really want to just take an image of the drive, stash that somewhere for later, and reformat the drive so I can use it normally. I don't want to lose any of my files on the drive.

Question: Is there a way to take an (compressed?) image of the drive that will preserve it bit-for-bit and allow me to do forensics later?


2 Answers 2


Just copying the device someplace should work:

dd if=/dev/whatever of=/some/file/to/save

The default blocksize (bs=...) flag should be fine, in any case setting it wrong will at most make it slow down.

If the filesystem might be broken due to hardware problems, experiment with other filesystems first, and make sure the bs is a multiple of the hardware block size. When disks start behaving erratically, they usually have at most hours of life left in them.

  • What about compressing the dump?
    – m13r
    Aug 8, 2014 at 11:07

You should be able to use raw to bind the partition's block device to a raw character device and then use dd to read the partition image. Make sure that bs is the actual sector size of the disk, or some multiple thereof. (The default should work, I believe.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.