Announcement

Collapse
No announcement yet.

Clone an SSD Drive.

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • #16
    Originally posted by David (PassMark) View Post
    I think you made a similar post in another forensics forum, also stating that "dd" failed.
    https://www.forensicfocus.com/forums...-an-ssd-drive/

    You also made the comment that "others" had used a HDD cloning station and it worked. Which is different from the comment you made here, where you implied you used a HDD cloning station and it works (and thus the problem was solved).

    So I think you need to consider the possibility that it might be hardware failure. Then work through the options to narrow down what the cause is.
    1) Try 'dd' and / or OSF on a different computer (with different SATA cabling).
    2) Try a different destination drive.
    3) Check the SMART data on the source drive for failure indicators.
    Thank you.
    As I said, the HDD Docking can clone the drive, then why "dd" or "OSForensics" can't? I want to have an image of the disk.
    I think the source and cloned had differences hashes because I plugged the cloned SSD Drive into the device and device written or...data on it. I must recompute the hashes.
    Is "OSFClone" vs "Create Drive Image"?

    Comment


    • #17
      As I said, the HDD Docking can clone the drive, then why "dd" or "OSForensics" can't?
      You said someone else used the HDD Dock and it worked. So I assume (at this point) that they didn't have bad hardware, but you might.

      I think the source and cloned had differences hashes because I plugged the cloned SSD Drive into the device and device written or...data on it.
      Yes, you need to check the hashes straight away. If you booted the drive later on, then the boot process will have written data to the drive and the hashes won't match.

      Is "OSFClone" vs "Create Drive Image"?
      OSFClone is basically a self booting version of dd, with a slightly better user interface and error handling.

      Comment


      • #18
        No, I have not any hardware problems like cable or...
        I will regenerate the hashes.
        In your opinion, is OSFClone better for me?

        Comment


        • #19
          I can only see 3 possibilities.
          1) The "dd" command has been around since 1987. So maybe you found a bug in dd after 33 years. But this seems extremely unlikely.
          2) Your hardware is special in some way. e.g. the BIOS is locked to to only use 1 model of hard drive
          3) You have a hardware fault. Even if you think you don't.



          Comment


          • #20
            I regenerate hashes and both of original and cloned SSD have same hashes:

            Code:
            Original:
            
            Partition 0:
            Size: 1.10 GB
            
            SHA-1: 9c1c0c22b2d4eada6ee3044d8903cbece0e88fc4
            MD5: e8a7840f01a0839d96f31646171a832b
            
            
            Partition 1:
            Size: 6.58 GB
            
            SHA-1: a2128f780c7a0d22ad5dfb7fec7d5bd2e0f75dd8
            MD5: e41bd2dc2ebb2aa7b0669f523234e3bf
            
            
            
            Partition 2:
            Size: 14.09 GB
            
            SHA-1: 69cc89ec6a47ecc053c626afbcdb65b7130819c5
            MD5: 716d8113743063a924d34411dd30ef27
            
            
            Partition 3:
            Size: 1.10 GB
            
            SHA-1: 59aaf85e166ab503c0f64e3cf861f847d0c31241
            MD5: 4e81c7d248e0f54a267b9253ff3f4182
            
            
            Partition 4:
            Size: 6.59 GB
            
            SHA-1: ac0617096f320a4800c66aca0a88fd96237d546c
            MD5: c31d194d32eeae8100ba6b346308af77
            
            
            Partition 5:
            Size: 82.33 GB
            
            SHA-1: c3d0cf989c17cc8fae518ab8729df3d4f9599eb5
            MD5: b779439080a8a19c6f38f99883d86d9a
            Code:
            Cloned:
            
            Partition 0:
            Size: 1.10 GB
            
            SHA-1: 9c1c0c22b2d4eada6ee3044d8903cbece0e88fc4
            MD5: e8a7840f01a0839d96f31646171a832b
            
            
            Partition 1:
            Size: 6.58 GB
            
            SHA-1: a2128f780c7a0d22ad5dfb7fec7d5bd2e0f75dd8
            MD5: e41bd2dc2ebb2aa7b0669f523234e3bf
            
            
            
            Partition 2:
            Size: 14.09 GB
            
            SHA-1: 69cc89ec6a47ecc053c626afbcdb65b7130819c5
            MD5: 716d8113743063a924d34411dd30ef27
            
            
            Partition 3:
            Size: 1.10 GB
            
            SHA-1: 59aaf85e166ab503c0f64e3cf861f847d0c31241
            MD5: 4e81c7d248e0f54a267b9253ff3f4182
            
            
            Partition 4:
            Size: 6.59 GB
            
            SHA-1: ac0617096f320a4800c66aca0a88fd96237d546c
            MD5: c31d194d32eeae8100ba6b346308af77
            
            
            Partition 5:
            Size: 82.33 GB
            
            SHA-1: c3d0cf989c17cc8fae518ab8729df3d4f9599eb5
            MD5: b779439080a8a19c6f38f99883d86d9a
            As you see, SMART of both drives are OK.
            I have two questions:
            1- Why I can't remove DCO of the cloned drive?
            2- Drives have same hashes, but why when I compare two volumes with "Hex Editor Neo" tool, then they are different?
            Attached Files
            Last edited by Hack3rcon; 12-23-2020, 12:45 PM.

            Comment


            • #21
              DCO error:
              Attached Files

              Comment


              • #22
                Drives have same hashes, but why when I compare two volumes with "Hex Editor Neo" tool, then they are different?
                Impossible. Your methodology must be flawed. Maybe hashing the same drive twice, or the drives aren't write protected and you are comparing the hex values after additional data has been written to them (after computing the hashes).

                That DCO error was just saying that DCO can not be detected / altered on that drive.

                Comment


                • #23
                  It is odd for me too, but it is true.
                  BTW, as you see, both of SSD Drives are OK and doesn't have any hardware problem.
                  Why cloning not work?

                  Comment


                  • #24
                    Question has already been answered above.

                    Comment


                    • #25
                      Originally posted by David (PassMark) View Post
                      Question has already been answered above.
                      Answered?
                      Do you like I record my screen and after it you will see that it is true and I cloned it properly, but not worked?

                      Comment


                      • #26
                        Yes answered.

                        1) The "dd" command has been around since 1987. So maybe you found a bug in dd after 33 years. But this seems extremely unlikely.
                        2) Your hardware is special in some way. e.g. the BIOS is locked to to only use 1 model of hard drive
                        3) You have a hardware fault. Even if you think you don't.

                        Comment


                        • #27
                          Originally posted by David (PassMark) View Post
                          Yes answered.
                          Did you read my previous messages?
                          1- I used OSForensics for create this image and not "dd" tool.
                          2- Did you see the SMART screenshot of both SSD Drives? Both drives are OK.
                          3- MITEL BIOS?

                          Comment

                          Working...
                          X