Announcement

Collapse
No announcement yet.

Clone an SSD Drive.

Collapse
X
Collapse
 
  • Page of 2
  • Filter
  • Time
  • Show
Clear All
new posts
Previous 1 2 template Next
  • #1

    Clone an SSD Drive.

    Hello,
    I want to clone the SSD Drive of a MITEL 3300 device => https://americantelebrokers.com/pub/....2014.402x.jpg
    I used OSForensics to clone this SSD Drive and checked it too:

    Click image for larger version Name: Capture-1.PNG Views: 0 Size: 13.9 KB ID: 49295

    Click image for larger version Name: Capture-2.PNG Views: 0 Size: 16.7 KB ID: 49296

    And restored this image on a new SSD Drive with the same capacity:

    Click image for larger version Name: Capture-4.PNG Views: 0 Size: 10.7 KB ID: 49297

    But seems not working!!!
    What is wrong?

    Thank you.
    Tags: None
  • #2
    ....not working
    Can you provide more details.
    Was there an error message?

    Can you check the exact size of both SSDs in bytes. Sometimes two 120GB drives aren't exactly the same size.

    It looks from the screen shot that both the source and ultimate destination are the same. You copied PhysicalDrive1 to PhysicalDrive1? Maybe you picked the wrong destination drive, and it should have been PhysicalDrive2 ?

    Comment

    • #3
      Originally posted by David (PassMark) View Post

      Can you provide more details.
      Was there an error message?

      Can you check the exact size of both SSDs in bytes. Sometimes two 120GB drives aren't exactly the same size.

      It looks from the screen shot that both the source and ultimate destination are the same. You copied PhysicalDrive1 to PhysicalDrive1? Maybe you picked the wrong destination drive, and it should have been PhysicalDrive2 ?
      Thank you.
      How can I calculate the size in in bytes?
      No, PhysicalDrive2 is my internal HDD.
      I don't know ask this question is OK or not, but is OSForensics more powerful than "DD" in Linux?
      In Linux, the disk structure is:
      Code:
      $ lsblk -f
NAME FSTYPE LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINT

sdc                                                                   
├─sdc1
│    vfat   /sysro
│                 020C-0000                                           
├─sdc2
│    vfat   /db   0257-0000                                           
├─sdc3
│    vfat   /vmail
│                 02F6-0000                                           
├─sdc4
│                                                                     
├─sdc5
│    vfat   /sysro
│                 036A-0000                                           
├─sdc6
│    vfat   /db   037F-0000                                           
└─sdc7
     vfat   /unused
                  03FA-0000
      I created an image with "dd" too:
      Code:
                                         Disk: SSD.dd
             Size: 111.8 GiB, 120034123776 bytes, 234441648 sectors
                       Label: dos, identifier: 0x48f7a8ec

    Device        Boot       Start        End   Sectors  Size Id Type
>>  SSD.dd1         *             63    2313359   2313297  1.1G  6 FAT16         
    SSD.dd2                  2313360   16113194  13799835  6.6G  b W95 FAT32
    SSD.dd3                 16113195   45656729  29543535 14.1G  c W95 FAT32 (LBA)
    SSD.dd4                 45656730  234441647 188784918   90G  f W95 Ext'd (LBA)
    ├─SSD.dd5               45656793   47954024   2297232  1.1G  6 FAT16
    ├─SSD.dd6               47954088   61769924  13815837  6.6G  b W95 FAT32
    ├─SSD.dd7               61769988  234436544 172666557 82.3G  b W95 FAT32
    └─Free space         234438656  234441647      2992  1.5M
 ┌──────────────────────────────────────────────── ────────────────────────────┐
 │  Partition type: FAT16 (6)                                                 │
 │      Attributes: 80                                                        │
 │ Filesystem UUID: 020C-0000                                                 │
 │Filesystem LABEL: /sysro                                                    │
 │      Filesystem: vfat                                                      │
 └──────────────────────────────────────────────── ────────────────────────────┘
      I guess, the device is running kind of Linux or QNX OS!!!

      Comment

      • #4
        When I plugged the cloned SSD Drive to the device then it just rebooted.
        Any idea?

        Comment

        • #5
          If you are in Windows (and OSF only runs in Window) then you can check size of a physical drive from the Windows's "Disk management" app. Right click on the drive and select Properties. The screen shots from QNX only seem to show 1 physical hard drive. And I would have expected two is you are cloning a drive?

          is OSForensics more powerful than "DD" in Linux?
          Yes.
          But if your only job is cloning a drive and you don't care about checksums / verification, then DD can work.

          Again it would help if you could elaborate on what "not working" means.

          Not sure what machine you are using for this, if you are doing the cloning directly on the MITEL 3300, or not.
          But it might make sense to pull the old drive and put both the old a new drive into a more standard Windows desktop machine to clone them.

          Comment

          • #6
            Thank you.
            In the image number 1, "\\.\PhysicalDrive1" is the MITEL 3300 SSD Drive that I cloned it into my internal HDD (Drive D) Drive. In the image number 3, "\\.\PhysicalDrive1" is the new SSD Drive that I used for cloning.
            When I plugged the cloned SSD Drive into MITEL 3300 device and turn it on, then device can't boot and just rebooted.
            Both SSD Drives (Original and Cloned) are 120 GB.
            The interesting thing is that the "Cloning" button on HDD Docking device can clone that drive and it worked!
            Why HDD Docking can do it but OSForensics can't?

            Comment

            • #7
              Don't know why it didn't work. Would need more investigation and a bit of experimentation. e.g.
              - Was it a hardware issue. e.g. Cabling or sector failure on the drive.
              - Was it a one off issue or reproducible
              - Was the correct boot drive selected on the MITEL device
              - Was the source drive a standard drive (there can't sometimes be tricky hidden areas on drives with DCO and HPA). OSF can help checking this.
              - If you look a the boot sector of both the source and destination drive in a hex editor do they appear the same. OSF can help with this as well.
              - If you look at the partitioning of the two drives are they the same. OSF can help with this. But you can check in Windows Disk management.
              - Are the drives exactly the same size to the byte.

              Comment

              • #8
                Thank you so much.
                I uploaded some images about the information that you wanted.
                Code:
                Original:

Offset | 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 | ASCII
------------------------------------------------------------------------------------------------
000000000000 | 90 90 C3 57 69 6E 64 20 52 69 76 65 72 20 53 79 | ...Wind River Sy
000000000016 | 73 74 65 6D 73 20 49 6E 63 2E 2C 20 44 6F 73 46 | stems Inc., DosF
000000000032 | 73 20 32 2E 30 20 50 61 72 74 69 74 69 6F 6E 20 | s 2.0 Partition
000000000048 | 54 61 62 6C 65 00 00 00 00 00 00 00 00 00 00 00 | Table...........
000000000064 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000080 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000096 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000112 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000128 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000144 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000160 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000176 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000192 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000208 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000224 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000240 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000256 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000272 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000288 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000304 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000320 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000336 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000352 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000368 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000384 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000400 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000416 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000432 | 00 00 00 00 00 00 00 00 EC A8 F7 48 FC F9 80 01 | ...........H....
000000000448 | 01 00 06 FE 3F 8F 3F 00 00 00 51 4C 23 00 00 00 | ....?.?...QL#...
000000000464 | 01 90 0B FE FF EA 90 4C 23 00 9B 91 D2 00 00 00 | .......L#.......
000000000480 | C1 EB 0C FE FF FF 2B DE F5 00 6F CC C2 01 00 00 | ......+...o.....
000000000496 | C1 FF 0F FE FF FF 9A AA B8 02 16 A1 40 0B 55 AA | ............@.U.
000000000512 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000528 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000544 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000560 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000576 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000592 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000608 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000624 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000640 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000656 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000672 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000688 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000704 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000720 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000736 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000752 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
                Code:
                Cloned:

Offset | 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 | ASCII
------------------------------------------------------------------------------------------------
000000000000 | 90 90 C3 57 69 6E 64 20 52 69 76 65 72 20 53 79 | ...Wind River Sy
000000000016 | 73 74 65 6D 73 20 49 6E 63 2E 2C 20 44 6F 73 46 | stems Inc., DosF
000000000032 | 73 20 32 2E 30 20 50 61 72 74 69 74 69 6F 6E 20 | s 2.0 Partition
000000000048 | 54 61 62 6C 65 00 00 00 00 00 00 00 00 00 00 00 | Table...........
000000000064 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000080 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000096 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000112 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000128 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000144 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000160 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000176 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000192 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000208 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000224 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000240 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000256 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000272 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000288 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000304 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000320 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000336 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000352 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000368 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000384 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000400 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000416 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000432 | 00 00 00 00 00 00 00 00 EC A8 F7 48 FC F9 80 01 | ...........H....
000000000448 | 01 00 06 FE 3F 8F 3F 00 00 00 51 4C 23 00 00 00 | ....?.?...QL#...
000000000464 | 01 90 0B FE FF EA 90 4C 23 00 9B 91 D2 00 00 00 | .......L#.......
000000000480 | C1 EB 0C FE FF FF 2B DE F5 00 6F CC C2 01 00 00 | ......+...o.....
000000000496 | C1 FF 0F FE FF FF 9A AA B8 02 16 A1 40 0B 55 AA | ............@.U.
000000000512 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000528 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000544 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000560 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000576 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000592 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000608 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000624 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000640 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000656 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000672 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000688 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000704 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000720 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000736 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000752 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000768 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000000000784 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
                Attached Files

                Comment

                • #9
                  Nothing obvious in those screen shots. It looks like the clone is identical (size, partitioning and bytes in 1st sector).

                  You could try hashing the partitions and see if the hashes match. Maybe one partition had a sector fail.

                  Comment

                  • #10
                    Thank you.
                    How about "HPA" and "DCO" ?
                    How can I hashing the partitions?

                    Comment

                    • #11
                      You can check the hashing with the Verify / Create hash function in OSF. Pick you hash function, then Calculate.

                      Click image for larger version Name: Hashing2.png Views: 473 Size: 63.1 KB ID: 49443

                      Comment

                      • #12
                        Thank you.
                        Information are:
                        Code:
                        Original:

Partition 0:
Size: 1.10 GB

SHA-1: 20f9d5196736771e6bffb0c12052e996d35e8df3
MD5: dd5a5ffb08d35d7758a77c9dacba3874


Partition 1:
Size: 6.58 GB

SHA-1: 8018ce32f313cabfd8ebf9fb7f14a1d79988a1b0
MD5: d5277242c62bde2ec3932049d65229ab



Partition 2:
Size: 14.09 GB

SHA-1: 1a3385d06f9ce95af80669b1af29d6d3a9e436ce
MD5: 7845181ea5c5467a7219ed714d97b09c


Partition 3:
Size: 1.10 GB

SHA-1: 77216106ff98a77479a81b95abd10b4a4a5cc46f
MD5: 032e997221da902b884ce23b26c6d0e9


Partition 4:
Size: 6.59 GB

SHA-1: 507276ebc81fdadd4dcd36b9ac2c024f7d52ddc9
MD5: 7cf0951a2fd6c4e9bbd101688b719ddb


Partition 5:
Size: 82.33 GB

SHA-1: c3d0cf989c17cc8fae518ab8729df3d4f9599eb5
MD5: b779439080a8a19c6f38f99883d86d9a
                        And:
                        Code:
                        Cloned:

Partition 0:
Size: 1.10 GB

SHA-1: 88b4f781a66f8407326bde847c16114e40b7aacf
MD5: 8e67ea69b7d17bf867760175b6697d11


Partition 1:
Size: 6.58 GB

SHA-1: 6f623c54386e4346fd72cb09ea4539b38543575b
MD5: 2f3ad684cac91559646242764e984355



Partition 2:
Size: 14.09 GB

SHA-1: a91ad5962611ca36746283de9bc6c3d28921aeb0
MD5: dfbd62f46af3d3d4c6a2989f0a0c12a3


Partition 3:
Size: 1.10 GB

SHA-1: 6dab8007bed89608bca5bd026c0aee9c45dbd48b
MD5: c5779f6cb8b00106799cbd08d468ca79


Partition 4:
Size: 6.59 GB

SHA-1: 980908929ee34d2ca09e15dab1a7bc474b00e587
MD5: ab7e328be37708cbc1a597a4e115782e


Partition 5:
Size: 82.33 GB

SHA-1: a22fa1ba60062cf4981c23d0b8cbee807679cc82
MD5: 1685d0acb10c0d4e4d2ef8b419c0c588
                        When I plugged the cloned SSD Drive into the device, then in the below stage system stopped and rebooted:
                        Code:
                        MITEL SYSTEM ROM R3.1/10 Aug 5 2011 (83 - POWER_ON_RESET)

CCA Number : 56009581 Ra.4
System Model : 00620001 F2500
CPU Model : 8360 R80480021
Reset Config Low : 0804008c
Reset Config High : b4500006
Coherent System Bus Clock (MHz) : 266
CPM Clock (MHz) : 399
Core Clock (MHz) : 533
DDR Clock (MHz) : 133
Local Bus Clock (MHz) : 66
Input Clock (MHz) : 33
Internal Memory Map : f0000000
Main Memory (MB) : 512
Local Memory (MB) : 0
Flash Memory (MB) : 4
MAC Address : 08000f640a40
POST Bypass : 0
Watchdog Bypass : 0
Slot Id : 0

Starting POST...

SDRAM CS1 Data Bit Walk 1................... PASSED
SDRAM CS1 Data Bit Walk 0................... PASSED
SDRAM CS1 Address Walk 1................... PASSED
SDRAM CS1 Address Walk 0................... PASSED
SDRAM CS1 March Test........................ PASSED

Starting vxWorks...

Decompressing FPGA image...615412 bytes decompressed successfully

Programming the FPGA image...OK

FPGA version 0002:6123 loaded

SATA RAID Controller Not Present.











VxWorks System Boot


Copyright 1984-2002 Wind River Systems, Inc.





CPU: Mitel MMC-C PPC83XX F2500
Version: VxWorks5.5.2
BSP version: 3.1/10
Creation date: Aug 5 2011, 18:41:11




Press <SPACE><SPACE><SPACE> to stop auto-boot AFTER countdown starts...
<7><6><5><4><3><2><1><0>
auto-booting...


boot device : ata=0
unit number : 0
processor number : 0
host name : bootHost
file name : /partition1/RTC8260
inet on ethernet (e) : 172.18.6.5:fffffff0
host inet (h) : 192.168.137.10
gateway inet (g) : 172.18.6.14
user (u) : ftp
ftp password (pw) : ftp
flags (f) : 0x0
target name (tn) : MyPhone
other (o) : qefcc


Disk Configuration Started.
Creating block device for controller 0 drive 0... done.
Creating CBIO device for controller 0 drive 0... done.
0KB added to /partition1 partition
free disk space after partition 0 is 0KB
0KB added to /partition2 partition
free disk space after partition 1 is 0KB
0KB added to /partition3 partition
free disk space after partition 2 is 0KB
0KB added to /partition4 partition
free disk space after partition 3 is 0KB
Attaching to partition table for 4 partitions on controller 0 drive 0... done.
Creating Cache Layer for partition 0 (/partition1) on controller 0 drive 0... done.
Creating Cache Layer for partition 1 (/partition2) on controller 0 drive 0... done.
Creating Cache Layer for partition 2 (/partition3) on controller 0 drive 0... done.
Creating Cache Layer for partition 3 (/partition4) on controller 0 drive 0... done.
Creating Dos FS device for partition 0 (/partition1) on controller 0 drive 0... done.
Creating Dos FS device for partition 1 (/partition2) on controller 0 drive 0... done.
Creating Dos FS device for partition 2 (/partition3) on controller 0 drive 0... done.
Creating Dos FS device for partition 3 (/partition4) on controller 0 drive 0... done.
Disk Configuration Complete.
Loading /partition1/RTC8260...66125120
Starting at 0x6857c8...
                        How can I find the difference and do a deep analysis?
                        Attached Files

                        Comment

                        • #13
                          I compared two partitions (Original and cloned) with WinHex and it found "44,365" differences:
                          Code:
                          Offsets: hexadec.

25:    00 01
23A72: 82 8F
23A92: 82 8F
23BB2: 82 8F
23F72: 82 8F
23FB2: 82 8F
24012: 82 8F
24072: 82 8F
240D2: 82 8F
24112: 82 8F
241F2: 82 8F
24232: 82 8F
...
                          Why? Any idea to replace these offsets?

                          Comment

                          • #14
                            Any idea to solve it?
                            How can I find "0x6857c8" ?

                            Comment

                            • #15
                              I think you made a similar post in another forensics forum, also stating that "dd" failed.
                              https://www.forensicfocus.com/forums...-an-ssd-drive/

                              You also made the comment that "others" had used a HDD cloning station and it worked. Which is different from the comment you made here, where you implied you used a HDD cloning station and it works (and thus the problem was solved).

                              So I think you need to consider the possibility that it might be hardware failure. Then work through the options to narrow down what the cause is.
                              1) Try 'dd' and / or OSF on a different computer (with different SATA cabling).
                              2) Try a different destination drive.
                              3) Check the SMART data on the source drive for failure indicators.

                              Comment

                              Previous 1 2 template Next
                              Working...
                              X