1

Following up from How to create an accurate byte-level copy of an SSD to another drive?, I did a clone of my entire internal 256GB SSD of my Mac 10.14, with 13-15GB free areas. I have .img file now.

Will trying to do data recovery from a clone of a drive affect the chances of recovery VS doing recovery on the drive itself? Do all data recovery software that can attempt to recover data on the original drive also be able to attempt to recover data from .img clone that I have?

2
  • What steps made the clone? (Precise commands if you have them) your statement generalizing to all data recovery software also limits your options to the lowest common denominator. My hunch is your clone could lose a lot of data and possibly limit recovery, Also, the mac model and drive controller chip will affect your chances dramatically.
    – bmike
    Commented Jul 19, 2019 at 10:07
  • @jksoegaard after the .img file / clone is made. How will a data recovery recognise it as something I would like to do a recovery on? Most software will only show partitions and drives and require a user to choose one to do recovery Commented Jul 20, 2019 at 8:47

2 Answers 2

1

No, there's no difference when you have a byte-for-byte identical clone as you have. And yes, data recovery software should work the same for an original drive as for an image-based clone.

In other cases than yours there could be a slight difference - namely when we're dealing with defective hardware. If you have a broken hard drive for example it might be that if you do a naive clone multiple times, you'll end up with different images. That is not good.

In your case, I advised you to use "dd" to create a clone. That works perfectly well with functioning hardware.

If you had broken hardware, I would have advised instead to use "ddrescue". That utility has support for things like reading the same block multiple times in order to get as much correct data as possible from a malfunctioning drive. Also it can do stuff like leave holes in the clone image that corresponds to the non-working parts of the original drive.

Note that because of TRIM a functioning SSD drive could limit your possibilities of recovering data from the clone. However if you use data recovery software you run yourself on your Mac, then the clone and the original will let you recover exactly the same data.

The only difference is if you access the flash ICs on the SSD drive directly to try to recover data that has been TRIM’ed away. However that is not possible from macOS (or Windows or similar), rather you would typically need specialized hardware and software not commonly available. If you are considering sending in your data to a professional recovery service that has these capabilities, you’ll definitely want to stop using the original drive and send that in - and the continue working on your clone drive instead. NOTE: I know of no such recovery service in existence anywhere for your hardware - I think your only bet is Apple at the moment.

13
  • I like your reasoning for HDD, but SSD don’t do block copies since the controller is faking logical storage to obscure things like COW, TRIM, etc.... my gut feeling is the answer should be, yes there are massive differences and the clone is mostly useless for recovery.
    – bmike
    Commented Jul 19, 2019 at 10:54
  • @bmike That’s a misunderstanding - what you write is completely incorrect. You can use the exact same method to create a clone of an SSD, and it will be just as good for recovery as one made of a hard drive. TRIM does not enter the picture here. CoW is not implemented by the SSD, so it doesn’t matter at all here.
    – jksoegaard
    Commented Jul 19, 2019 at 11:10
  • 1
    @bmike With further consideration - you actually have a point! I looked back and saw that the original reason behind the clone was because the user had inadvertently deleted files from the drive. In that case TRIM does play a role, as the data could then more likely have been overwritten - or have been made inaccessible from the operating system. In any case it doesn’t change that the tools suggested are the right ones, and you cannot make a more “correct” clone from macOS. As for data recovery it is possible that more data could be recovered by accessing the SSD flash ICs directly.
    – jksoegaard
    Commented Jul 19, 2019 at 11:34
  • 2
    However that is not really possible from macOS - so in that case an “ordinary” user would need to send in the drive to a (costly) recovery service. If that is what he wants to do - he needs to send in the original drive (without using it anymore), and not a clone.
    – jksoegaard
    Commented Jul 19, 2019 at 11:35
  • Again. No way I would down vote your very thoughtful answer. Just that whatever copy the OP did won’t reveal any data he could have copied by finder. The “image” still trusts the filesystem view and not the storage reality.
    – bmike
    Commented Jul 19, 2019 at 11:55
0

In your specific case

With the command you used, if dd encountered errors it just stops. So if no errors were reported when you used it, then you are good to go: there are no meaningful differences in your case as described.

The main difference is it will increase your chances of success when working with a damaged drive: Making an image/clone of a damaged drive and then working from the image (while the original is set aside someplace safe) will increase the chances of recovery because, once a drive becomes damaged, further use of the drive will often aggravate the issues. For example, using a damaged drive can corrupt more data, or do more damage and make the drive stop working altogether.

General Answer

The command you linked dd if=/dev/rdisk1s1 of=/Volumes/ExternalDrive/clone.img bs=1m doesn't have the most robust options for dd to create an image from a damaged drive.

Adding conv=noerror,sync will make dd continue, even if errors are found, and write null bites in place of unreadable blocks.

dd bs=4k if=/dev/rdisk1s1 of=/Volumes/ExternalDrive/clone.img conv=noerror,sync

Alternately use a utility like ddrescue which has an option to specify the number of times to retry reading a block that could not be read.

2
  • You seem to have missed that this is the same guy asking follow-up questions. He hasn’t got a damaged drive, but a fully functioning drive where he accidentally deleted files he didn’t mean to delete.
    – jksoegaard
    Commented Jul 19, 2019 at 11:41
  • Yep, I did miss that. I'll update my answer. Thank you.
    – timeSmith
    Commented Jul 19, 2019 at 11:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .