How do I image a hard drive with an unknown format?

[bolex]

I have an imbedded device (floppy duplicator) from the early 90's that has a 500MB IDE drive in it. I want to backup and image this IDE drive. I've tried Clonezilla, but since the disk format is unknown, it errors out will not back up the drive. Are there any tools out there that don't look at the file system and just copy the drive bit by bit? Is that even possible?

 

[SomeGuy]

Yes, use a Linux boot CD or attach it to a Linux system and then use the "dd" utility to copy the drive bock device to a file. It won't care what file system is there or if there is even no file system at all. You can then pick through the file later to determine content.

It gets a little harrier if there are bad sectors.

Since the drive is less than 2GB, you can also achieve something similar with a DOS computer and Norton Disk Editor.

 

[jafir]

When you’re trying to back it up with clonezilla are you trying to use a USB to IDE device if some sort? If so, that might be the source of your problems, most of those don’t work with IDE drives that old/small.

 

[bolex]

When you’re trying to back it up with clonezilla are you trying to use a USB to IDE device

I put this in a drive enclosure/sled and it's directly attached to the IDE header on the motherboard. I thought I would have the problem you mentioned if I did it any other way. The drive is recognized by the BIOS. This is an older system (6 cores), but it's running windows 10.

 

[bolex]

I tried DD a few times with no success and I tried to run Clonezilla in DD mode instead of PART mode and that still gave me errors. Truthfully my linux skills are horrible at best. Since this was on a windows 10 machine, I found a tool called HDD Raw Copy Tool that does a DD in windows. It's running now. I'll check out the image with some binhex forensic tools that I have to see what it looks like when its done.

 

[bolex]

This is the first recognizable data on the drive. Anyone recognize it?

 

[Chuck(G)]

The hex means more to me than does the interpreted stuff; got a display of that? dd running natively under linux should have had no problem with it.

 

[tradde]

I wonder if the device he passed to DD was not the correct one? You are right DD should have worked easily.

 

[bolex]

The hex means more to me than does the interpreted stuff; got a display of that?

Here are the top 100,000 rows. It would be interesting to see how it stores the disk image files. I can get you the whole dump if you like.

 

[Chuck(G)]

A quick examination tells me that this is not an X86 (perhaps 68K). The filesystem is pretty simple, but you can see that there's a nUxi-type issue:

00105ab0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00105ac0  00 00 00 00 00 00 00 00  1f 0e c0 33 8e fa bc d0  |...........3....|
00105ad0  7c 00 be fb 7c 76 ac fc  c0 84 08 74 0e b4 07 b3  ||...|v.....t....|
00105ae0  10 cd f3 eb 00 b4 16 cd  19 cd 00 00 00 00 00 00  |................|
00105af0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00105b00  0a 0d 6f 4e 2d 6e 79 53  74 73 6d 65 64 20 73 69  |..oN-nyStsmed si|
00105b10  20 6b 72 6f 64 20 73 69  20 6b 72 65 6f 72 0d 72  | krod si kreor.r|
00105b20  0d 0a 52 0a 70 65 61 6c  65 63 61 20 64 6e 73 20  |..R.pealeca dns |
00105b30  72 74 6b 69 20 65 6e 61  20 79 65 6b 20 79 68 77  |rtki ena yek yhw|
00105b40  6e 65 72 20 61 65 79 64  0a 0d 43 00 70 6f 72 79  |ner aeyd..C.pory|
00105b50  67 69 74 68 31 20 39 39  20 32 72 54 63 61 20 65  |gith1 99 2rTca e|
00105b60  6f 4d 6e 75 61 74 6e 69  50 20 6f 72 00 64 00 00  |oMnuatniP or.d..|
00105b70  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Take a look at 105b00 : should read 0d 0a 4e 6f 6e 2d ....
16 bit words, big-endian system. "Non-System disk or disk error..." So it's a boot sector.
You can determine the type of disk by looking a bit farther up:

00105a80  89 44 89 44 89 44 45 55  00 81 3c eb 54 90 61 72  |.D.D.DEU..<.T.ar|
00105a90  65 63 53 72 00 54 01 02  00 01 e0 02 40 00 f0 0b  |ecSr.T......@...|
00105aa0  00 09 00 12 00 02 00 00  00 00 00 00 00 00 00 00  |................|

eb 3c 90 54 72 61 63 65 72 53 54 = usual x86 jump , followed by the system name: "TracerST"
And so on...

This your unit?

 

[Chuck(G)]

For your edification, here your TopData file with the bytes swapped (Linux objcopy --reverse-bytes=2 does that)

 

[bolex]

Yep! That is my system it's a Tracer ST8000. It does have a 68K processor. It uses a 20 pin floppy drive like what is typically seen in older macs.

 

[DeltaDon]

I've used AOMEI Partition Assistant to clone some drives and I believe it has a sector by sector option, but I've not tried that option yet. How about Rufus? I'm not sure it is can clone by sectors.

 

[Chuck(G)]

I do note that there's a SIMCITY image in the dump.

 

[bolex]

I do note that there's a SIMCITY image in the dump.

I was testing on a few disk types. It's been able to copy 400, 800K Mac, Amiga Disks, 720K, 1.44 disks and 1.2MB 3-mode disks. There are quite a few test disks on there from me testing it. One great feature is that you can test the drive alignment by putting an AAD disk in it.