Is it possible to clone an iMac drive without opening and removing drive(s)?

[ThomasH]

I've run into the situation a few times where I have received a modern iMac (which needs to be cut open and is a - to extract the drive from, and put back together and reseal, (especially if there is a fusion drive)).
I have a case now where the client had an employee leave, and they want to see the employee's documents and what they were up to etc, as they suspect potential foul play.
The iMac is working normally and there is no reason to suspect the drive is bad, so I really want to try to clone the drive and then deep scan for deleted files / RAW recoverable data.
I suppose if I could boot from a USB boot drive with Data Rescue or Rstudio, I could just use the boot drive and scan it directly from that and export the results to an external drive.

Currently, I've put the iMac into target mode and connected via thunderbolt to a mac mini.

I've been able to run an old version of carbon copy cloner, from when it still had 'block copy'. Apparently, the new versions no longer have 'block copy'. Still, I'm not sure if 'block copy' in CCC is actually a sector-sector clone.... It completed in a reasonable amount of time (under 6 hours).
Alternately, I've tried to scan the iMac in target mode with Data Rescue 4 (on the mac mini), but it's going to take 4-14 days at the speed it's scanning to scan just a 1TB drive.

I've tried unsuccessfully to create a working bootwell drive with DR4... the usb bootwell drive gets created, but just doesn't work to boot any systems.

Anyone have suggestions for this situation? Do you think I just need to bite the bullet and remove the drive?
The customer's budget doesn't allow for a true 'forensic' case... They just want the ex-employee's old data, Including any deleted data to be recovered.

[jimmy]

Dear Sir,

Have you try this? build live CD and clone
https://sourceforge.net/projects/clonezilla/

[ThomasH]

I have not tried clonezilla, but I'm not clear whether it runs on a mac or not...or will run on a boot drive that will boot a mac.
I'm going to run a Carbon Copy Cloner experiment, and maybe also a SuperDuper attempt on a drive resized to 5GB, zeroed out, with 4GB of data on it after deleting the data on a mac and trashing it. Then we'll see if either of those actually clone the unallocated / all sectors or not. It just seems like there should be an easier way...

[lcoughey]

Here is my suggestion:

Boot MacOS via an external USB or Firewire drive. Connect another drive on which you want to clone/image to and then you can use pretty much any data recovery program to clone/image the patient.

[ThomasH]

Thanks Luke, It took a while after repeated failures of creating an external boot drive, but once I used a drive that didn't need to be powered through the USB port, I finally successfully created one.
(I've tried that a few times over the years, always with a portable external, which never worked.) This time I used a bare drive in a powered dock and it worked well. I assume a powered desktop sized external would also work.

[ThomasH]

FYI,
After running the 5GB drive clone test (sample drive had 4GB of data, then all but a few files are deleted before attempting the cloning process), and when doing a hex-level fast-compare by scrubbing through the drives' sectors side-by-side in Winhex:

Data Rescue 5 does indeed appear to have cloned all of the sectors from the source, (including sectors occupied by deleted files).

Both Carbon Copy Cloner and Drive Genius 5's 'cloning' features only copied the active files, and did not copy the sectors with deleted data.

So it seems booting from a self-powered external drive with OSX + Data Rescue 5 on it, and then cloning is the best (and only) setup that did what I wanted so far.

[Roman_TS]

Here is the best way

1. Create Windows 10 - to-go drive;
2. Connect it to MacBook and boot from it;
3. Install PC-3000 Portable on Windows 10 to go drive;
4. Install HFS+ support for Windows 10;
5. Make sector by sector copy from HFS drive in Data Extractor;

http://blog.acelaboratory.com/pc-3000-o ... ation.html

The only problem - you need PC-3000 Portable with DE. But of course there are a lot of other software tools for imaging. Windows on Mac will help you to do anything you want.