Jump to content











Photo
- - - - -

Swiss army disk imaging tool?


  • Please log in to reply
17 replies to this topic

#1 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 24 March 2021 - 09:53 AM

Hello everyone,

                         can anyone recommend a disk imaging tool that is able to read all types of drive partition formats and can create RAW/BIN image file of them?  The ability to create a compressed image too would be ideal.

 

Specifically, I want to be able to create an image of a FAT32 partition with 2048 sectors.

 

It would be great if there was something out there that was portable, and runs on Win 2000/XP.  Non commercial would be perfect.

 

Thanks in advance.

 


  • Brito likes this

#2 steve6375

steve6375

    Platinum Member

  • Developer
  • 7566 posts
  • Location:UK
  • Interests:computers, programming (masm,vb6,C,vbs), photography,TV,films
  •  
    United Kingdom

Posted 24 March 2021 - 10:07 AM

Not quite sure what you want, but my RMPrepUSB.exe  Windows 32-bit utility might be what you want?

Use the  Disk -> File button

www.rmprepusb.com



#3 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 24 March 2021 - 10:33 AM

Hi Steve,

              I have an old iPod with an 80GB hard disk which I want to create an image of.  

I've just  tried using your RMPrepUSB tool with the default parameters (0,PALL,0)

and I get and error accessing sector 0 on the drive.  The drive boots and functions normally. 



#4 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 24 March 2021 - 10:37 AM

I get the same error with the USBInfo tool.



#5 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 24 March 2021 - 12:32 PM

I guess you've never heard of.....dd.

#6 steve6375

steve6375

    Platinum Member

  • Developer
  • 7566 posts
  • Location:UK
  • Interests:computers, programming (masm,vb6,C,vbs), photography,TV,films
  •  
    United Kingdom

Posted 24 March 2021 - 12:33 PM

Try using Diskpart - SEL DISK X -  DETAIL DISK

What does it show?

Maybe the disk has 4K sectors?



#7 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 25 March 2021 - 11:20 AM

The sector size is 2048 bytes.

I tried using dd.  I was able to create an image file.  When I restored it The geometry of the drive is now wrong.  It reports it as a 128.4GB with no partition.  I tried using DiskGenius to reinstate the correct geometry but I'm getting CRC error when trying to save the changes.

The drive shows as being removable and I'm unable to format it or wipe it because of the geometry.  What can I do to recover from this disaster? 



#8 steve6375

steve6375

    Platinum Member

  • Developer
  • 7566 posts
  • Location:UK
  • Interests:computers, programming (masm,vb6,C,vbs), photography,TV,films
  •  
    United Kingdom

Posted 25 March 2021 - 11:46 AM

How do you know the sector size is 2048?  Hard drives are usually 512 bytes or 4096 bytes.



#9 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 25 March 2021 - 11:52 AM

This is what all of the tools I have used report including DiskGenius and dmde on a working iPod drive.  The sector size is what Apple used in their wisdom on this particular model of iPod.



#10 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 25 March 2021 - 03:21 PM

I tried using dd.  

And you failed at it. :w00t:

 

You don't "try" using dd, you either use it (with a specific set of parameters) or you don't, there is no try ;).

 

dd is completely sector size (and source file or device content) agnostic, and if used with the correct parameters the result is a 1:1 image of the original.

 

The moment you "touch" the resulting image with any tool "smart" or "not so-smart" that want/need to interpret the contents of the image, then this other tool may fail at interpreting the contents of the image or - worse - change something in the image.

 

And IF the original is non-NT, and it has a MBR, the sheer moment you will attempt to connect/mount the image on a NT based system (NT 4.0 to 10) a Disk Signature (if not already present) will be written in the MBR, and this will void the checksum.

 

:duff:

Wonko



#11 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 25 March 2021 - 04:31 PM

Hi Wonko,

                Okay, I used dd and created a 1:1 image.  

When I attempted to restore this image to another working drive with identical specification I ran into some trouble.

 

The command I used to create the image was:

 

dd if=\\.\g: of="i:\ipod_hdd-2048.img" bs=8M --progress

 

Trying to restore it I used:

 

dd if="i:\ipod_hdd-2048.img" of=\\.\e: bs=8M --progress

 

Which gave an unspecified parameter error as I recall.  I think I had to use the following to start the image restoration:

 

dd if="i:\ipod_hdd-2048.img" of=.e: bs=8M --progress

 

I noticed that typing dd --list doesn't show any mounted volumes.

For example:

 

\\?\Device\Harddisk1\Partition0
link to \\?\Device\Harddisk1\DR4
Removable media other than floppy. Block size = 2048
size is 80026361856 bytes
\\?\Device\Harddisk2\Partition0
link to \\?\Device\Harddisk2\DR5
Fixed hard disk media. Block size = 512
size is 1000194400256 bytes
\\?\Device\Harddisk2\Partition1
link to \\?\Device\HarddiskVolume4
\\?\Device\Harddisk3\Partition0
link to \\?\Device\Harddisk3\DR8
Removable media other than floppy. Block size = 2048
size is 80026361856 bytes
\\?\Device\Harddisk3\Partition1

 

Normally connecting these disks on an NT system is just like any other device permitting the normal access to all the files.

I don't think the MBR is altered at all.  I'll post a copy of a working drive MBR later.

 

I think I need a tool that is able to accept the correct drive parameters and wipe the drive.  The trouble is everything I have tried results in CRC errors because I can't overide the settings.

I tried booting a Linux Distro and it doesn't mount the drive.     



#12 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 25 March 2021 - 05:56 PM

Yep, so you tried using the dd for windows port (actually re-write) by John Newbigin. (since it is a re-write it is entirely possible that it has issues with non-standard sector size)

 

For the record "mounted" is not (or not exactly) the same as "drive letter assigned", though this case seems like not connected to this.

 

If you want to wipe the drive (which is another thing) you simply write via dd (or similar) a sequence of 00 bytes.

 

Have you tried dsfo/dsfi from the DSFOK package?

Just in case:

http://reboot.pro/in...=22317&p=215243

 

As well, the disk imaging that is possible with DMDE should do nicely.

 

The writing to the MBR is "transparent to the user", briefly NT system identify uniquely disks by a 4 bytes sequence at offset 440 in the MBR.

When a NT system tries to access a disk there are two cases in which this sequence is written to the MBR of the disk:

1) extremely (and I mean extremely) rare case of a disk having the SAME disk signature of another connected disk (but that can happen when cloning[1]/imaging)

2) common case when a disk comes from a Linux or Dos system (that normally uses NOT a disk signature and thus the 4 bytes are 00000000) no idea about what Apple (and particularly on the IPOD) does

 

From the dd --list output you posted, it seems like you had both the source and target disk connected at the same time, and this is a no-no.

 

The "standard" procedure should be:

 

Source->image

Disconnect (physically) source disk

Connect target disk

image -> target disk 

 

:duff:

Wonko

 

 

[1] as a matter of fact unless you use this or that workaround, direct disk cloning is impossible under Windows NT



#13 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 27 March 2021 - 07:46 PM

Hi Wonko,

                many thanks for the detailed and informative reply. :)

 

dd was the only tool I tried that allowed me to wipe the drive without reported read/write errors.

I just ran the wipe routine for a few minutes before aborting to be able regain full access to the drive with other tools.

I was thinking that wiping sector 0 alone would be enough to achieve this but the available documentation is unclear to me.

I wondered if I could use the count  parameter for this task but didn't attempt this.  Do you know how to do this?

 

I haven't had a proper look at DSFOK page to see what this has to offer.  The documentation on this also wasn't particularly easy to follow at first look.

 

It has now clear to me that dd doesn't create 1:1 image that can be used by the iPod.

DMDE was able to able to achieve this with ease.



#14 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 28 March 2021 - 09:01 AM

Good that the issue was solved :).

 

As said, the dd for windows by John Newbigin is a very good tool but it is not really-really dd, since it has been re-written it may behave strangely with strange, rare setups.

 

In theory dd is (should be) "sector size agnostic" but there may be (actually there are) some limitations due to the NT technology/OS. 

 

The DSFOK package contains (among others) two different tools, dsfo and dsfi, that basically mean dsf-out and dsf-in, one gets data out of a device/file, the other gets data into device/file.

 

To give you an example of a possible issue that may be connected to what you experienced, dsfi cannot write on device less than a whole sector, and I believe this is due to the way the device is accessed under NT, if you need to change a single byte on device you dsfo the related sector to file, dsfi the single byte to the copied sector, then dsfi back the whole copied sector to the device, overwriting the whole original sector.

 

What is needed to "pseudo-wipe" a device in NT based systems largely depends, usually it is enough even to delete the "magic bytes" (55 AA), i.e. the last two bytes of the first sector of a hard disk like (partitioned) device to have it shown in Disk Manager as "need to initialize",

But other systems/OS may have completely different ideas on what to look for/what to check for.

 

To give you an example (only seemingly unrelated) check what kind of checks different OS/drivers do on floppies:

https://msfn.org/boa...&comment=987482

 

But - as another example - I have a couple machines that have a BIOS (Insyde) that checks the actual code in the MBR and decides whether to boot or not based on that (i.e. the DOS/2K/XP MBR code boots just fine, the grub4dos doesn't (actually later the grub4dos MBR code was changed so that it allowed booting), the syslinux does in some versions but doesn't in others), I wouldn't be surprised if the good Apple guys invented something similar for the Ipod.

 

About the count parameter what is the problem? :dubbio:

 

:duff:

Wonko



#15 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 28 March 2021 - 11:07 AM

Thanks for clarifying the technicals further for me.

 

The problem  was that the dd console tool doesn't provide any information about it in its help and it's the only mention of the count parameter is that it was added in release v0.5.

Since you asked, I had a look  the Unix docs to  see that setting count=1 is all that is required with a specified block size that matches the drive sector size.  Well, that is my understanding of it at least.   



#16 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 28 March 2021 - 11:12 AM

I thought I got that wrong, I think it should be bs=BYTES count=2048. 



#17 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 28 March 2021 - 01:36 PM

Well, 

BS means Block Size

Count means (blocks) count ;)

 

 

So if you want to transfer 1 (one) "normal" sector, i.e 512 bytes you can use (in theory) indifferently:

bs=1

count=512

OR:

bs=512

count=1

 

BUT:

1) due to the said limitation/quirk of NT, on device the bs=1 count=512 won't likely work

AND anyway, even on Unix/Linux

2) it will be (not very noticeable for such a small count) slow as molasses

 

The bs=1 count=512 basically means (pseudocode):

set counter=0

:loop

access source sector

read 1 byte at offset %counter%

access target sector

write 1 byte at offset %counter%

set counter+=1

if %counter% lss 512 goto :loop

 

Whilst the bs=512 count=1 basically means

access source sector

read it

access target sector

write it

 

So, generally speaking, and within the limits of the specific dd or dd-like tool (it depends, of course but a block size of 1-16 Mb is often possible/available) you should always have the biggest possible BS (that should be a multiple of sector size for physical devices, also called block based devices) and the smallest possible count, as it will be waaaaays faster.

 

:duff:

Wonko



#18 Nuvo

Nuvo

    Member

  • Members
  • 47 posts
  •  
    Scotland

Posted 28 March 2021 - 07:21 PM

Perfect.  Thank you for clarifying this for me Wonko. :)

I'll remember this should I ever revisit a similar problem.






1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users