Is it possible to clone an iMac drive without opening and removing drive(s)?

A place to discuss all topics that do not meet the rest of the conference

Moderators: Roman_TS, Maxim_TS


ThomasH
New user
Posts: 100
Joined: 11.01.12
Reputation: 2 / (22)

Is it possible to clone an iMac drive without opening and removing drive(s)?

Postby ThomasH » 12.10.17, 06:39

I've run into the situation a few times where I have received a modern iMac (which needs to be cut open and is a - to extract the drive from, and put back together and reseal, (especially if there is a fusion drive)).
I have a case now where the client had an employee leave, and they want to see the employee's documents and what they were up to etc, as they suspect potential foul play.
The iMac is working normally and there is no reason to suspect the drive is bad, so I really want to try to clone the drive and then deep scan for deleted files / RAW recoverable data.
I suppose if I could boot from a USB boot drive with Data Rescue or Rstudio, I could just use the boot drive and scan it directly from that and export the results to an external drive.

Currently, I've put the iMac into target mode and connected via thunderbolt to a mac mini.

I've been able to run an old version of carbon copy cloner, from when it still had 'block copy'. Apparently, the new versions no longer have 'block copy'. Still, I'm not sure if 'block copy' in CCC is actually a sector-sector clone.... It completed in a reasonable amount of time (under 6 hours).
Alternately, I've tried to scan the iMac in target mode with Data Rescue 4 (on the mac mini), but it's going to take 4-14 days at the speed it's scanning to scan just a 1TB drive.

I've tried unsuccessfully to create a working bootwell drive with DR4... the usb bootwell drive gets created, but just doesn't work to boot any systems.

Anyone have suggestions for this situation? Do you think I just need to bite the bullet and remove the drive?
The customer's budget doesn't allow for a true 'forensic' case... They just want the ex-employee's old data, Including any deleted data to be recovered.
Last edited by ThomasH on 12.10.17, 23:50, edited 1 time in total.


jimmy
Newbie
Posts: 6
Joined: 24.02.15
Reputation: 0 / (2)

Re: Possible to clone an iMac drive without opening and removing drive(s)

Postby jimmy » 12.10.17, 08:55

Dear Sir,

Have you try this? build live CD and clone
https://sourceforge.net/projects/clonezilla/


ThomasH
New user
Posts: 100
Joined: 11.01.12
Reputation: 2 / (22)

Re: Is it possible to clone an iMac drive without opening and removing drive(s)?

Postby ThomasH » 12.10.17, 23:53

I have not tried clonezilla, but I'm not clear whether it runs on a mac or not...or will run on a boot drive that will boot a mac.
I'm going to run a Carbon Copy Cloner experiment, and maybe also a SuperDuper attempt on a drive resized to 5GB, zeroed out, with 4GB of data on it after deleting the data on a mac and trashing it. Then we'll see if either of those actually clone the unallocated / all sectors or not. It just seems like there should be an easier way...


lcoughey
User
Posts: 230
Joined: 12.01.12
Reputation: 9 / (91)

Re: Is it possible to clone an iMac drive without opening and removing drive(s)?

Postby lcoughey » 13.10.17, 14:39

Here is my suggestion:

Boot MacOS via an external USB or Firewire drive. Connect another drive on which you want to clone/image to and then you can use pretty much any data recovery program to clone/image the patient.


ThomasH
New user
Posts: 100
Joined: 11.01.12
Reputation: 2 / (22)

Re: Is it possible to clone an iMac drive without opening and removing drive(s)?

Postby ThomasH » 16.10.17, 23:14

Thanks Luke, It took a while after repeated failures of creating an external boot drive, but once I used a drive that didn't need to be powered through the USB port, I finally successfully created one.
(I've tried that a few times over the years, always with a portable external, which never worked.) This time I used a bare drive in a powered dock and it worked well. I assume a powered desktop sized external would also work.


ThomasH
New user
Posts: 100
Joined: 11.01.12
Reputation: 2 / (22)

Re: Is it possible to clone an iMac drive without opening and removing drive(s)?

Postby ThomasH » 24.10.17, 19:37

FYI,
After running the 5GB drive clone test (sample drive had 4GB of data, then all but a few files are deleted before attempting the cloning process), and when doing a hex-level fast-compare by scrubbing through the drives' sectors side-by-side in Winhex:

Data Rescue 5 does indeed appear to have cloned all of the sectors from the source, (including sectors occupied by deleted files).

Both Carbon Copy Cloner and Drive Genius 5's 'cloning' features only copied the active files, and did not copy the sectors with deleted data.

So it seems booting from a self-powered external drive with OSX + Data Rescue 5 on it, and then cloning is the best (and only) setup that did what I wanted so far.

User avatar
Roman_TS
Site Admin
Posts: 600
Joined: 09.02.11
Reputation: 23 / (225)

Re: Is it possible to clone an iMac drive without opening and removing drive(s)?

Postby Roman_TS » 25.10.17, 21:35

Here is the best way :)

1. Create Windows 10 - to-go drive;
2. Connect it to MacBook and boot from it;
3. Install PC-3000 Portable on Windows 10 to go drive;
4. Install HFS+ support for Windows 10;
5. Make sector by sector copy from HFS drive in Data Extractor;

http://blog.acelaboratory.com/pc-3000-o ... ation.html

The only problem - you need PC-3000 Portable with DE. But of course there are a lot of other software tools for imaging. Windows on Mac will help you to do anything you want.
With best regards
ACELab technical support
ts.acelaboratory.com
blog.acelaboratory.com


Return to “Discussion club”

Who is online

Users browsing this forum: No registered users and 1 guest