Why did this dd copy of an encrypted Time Machine drive to another drive seem to have no effect?

Question

On macOS in past years I have been able to use dd to copy an entire hard drive to another hard drive of the same size. When I did this, everything was copied: the partition map, the volumes, everything. The copied-to drive was an exact copy of the original in all details.

Yesterday I tried the same thing in macOS Big Sur. The drive I copied from is encrypted and contains only one volume, which contains Time Machine backups.

Disk Utility says this about the drive I copied from:

• Drive model: “Seagate Desktop Media”
• Drive subtitle: “USB External Physical Disk – GUID Partition Map”
• Drive size: 8 TB
• Volume: “mybackup”, formatted as “CoreStorage Logical Volume” Disk Utility lets me decrypt-then-mount the “mybackup” volume.

The shell command I used to do the copy:

time caffeinate sudo gdd if=/dev/rdisk2 of=/dev/rdisk3 bs=1024M status=progress conv=noerror,sync

That ran for 28 hours. I assume that if there were errors, gdd would have said something. It did not.

Result: Disk Utility says this about the drive I copied to:

• Drive model: “Seagate Backup+ Hub BK Media”
• Drive subtitle: “USB External Physical Disk – GUID Partition Map”
• Drive size: 8 TB
• (no volumes)

Why no volume? Is there some metadata that needs to be copied but isn’t accessible in the raw disk contents?

There is no other disk that could have been /dev/rdisk3 and the copy did not go to a plain file.

UPDATE

Later, after reinstalling the OS on an erased disk, I tried to mount the copy again, and it worked.

Answer 1

you can copy TM volumes, using SuperDuper!, it takes a while (days to weeks running 24/7 for ~4tb) but it works.

I've done this to copy a standard HFS+ TM disk onto a CoreStorage Logical Volume Mac OS Extended (Journaled, Encrypted) disk, and from that disk 2 years later to another journaled encrypted disk.

You then need to go through the associatedisk stuff and inheriting the backup etc.

edit

Here's Shirt Pocket's documentation for copying a time machine volume with SuperDuper!:

https://www.shirt-pocket.com/forums/showthread.php?t=3565

Note, you need TM switched off during the copy, then you just have to have both drives mounted, and perform the copy, BUT it takes a loooong time. For example, copying from a WD Red internal SATA 3'5" to a WD Elements 2'5" portable over usb2 ~3.5TB of data - 3 weeks 24/7. Copying from that same WD Elements to a different WD Red Plus 3.5", both on USB2 ~3.5TB, 4 days 24/7, that was using a dedicated mac mini to do the job.

Once it's done, add the drive in Time Machine, but don't switch time machine automatic backups on yet.

You may need to inherit the backup, and then manually associate each of your drives with the backup, as per the Pondini instructions which you can currently find here:

http://oldtoad.net/pondini.org/TM/B6.html

• First, do the Inherit backup step, to link the duplicated backup drive to your current system (blue instructions).
• Then, do the Associate OSX Volume to connect your boot drive to its most recent backup (pink instructions).
• Thirdly, associate your non-bootable data-only volumes with their most recent backups (tan instructions).

Once that's all done, you can try a manual backup, first run this command in terminal:

log stream --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

and leave the terminal window open, it will provide a live commentary on what time machine is doing - watch the sizes of the predicted "Will Copy" for each of your backed up drives. What you're looking for is that it's only doing a incremental backup. If it says it's copying an amount that's equivalent to a whole new backup of the data, one of the above steps hasn't taken, so try them again. Or possibly your most recent backup was faulty. You can use tmutil to remove the most recent backup, and then go through the above steps again, to associate the current system and drives to the second-most-recent backup, etc.