Clone an SSD Drive.

[Hack3rcon]

I think you made a similar post in another forensics forum, also stating that "dd" failed.
https://www.forensicfocus.com/forums...-an-ssd-drive/

You also made the comment that "others" had used a HDD cloning station and it worked. Which is different from the comment you made here, where you implied you used a HDD cloning station and it works (and thus the problem was solved).

So I think you need to consider the possibility that it might be hardware failure. Then work through the options to narrow down what the cause is.
1) Try 'dd' and / or OSF on a different computer (with different SATA cabling).
2) Try a different destination drive.
3) Check the SMART data on the source drive for failure indicators.

Thank you.
As I said, the HDD Docking can clone the drive, then why "dd" or "OSForensics" can't? I want to have an image of the disk.
I think the source and cloned had differences hashes because I plugged the cloned SSD Drive into the device and device written or...data on it. I must recompute the hashes.
Is "OSFClone" vs "Create Drive Image"?

[David (PassMark)]

As I said, the HDD Docking can clone the drive, then why "dd" or "OSForensics" can't?

You said someone else used the HDD Dock and it worked. So I assume (at this point) that they didn't have bad hardware, but you might.

I think the source and cloned had differences hashes because I plugged the cloned SSD Drive into the device and device written or...data on it.

Yes, you need to check the hashes straight away. If you booted the drive later on, then the boot process will have written data to the drive and the hashes won't match.

Is "OSFClone" vs "Create Drive Image"?

OSFClone is basically a self booting version of dd, with a slightly better user interface and error handling.

[Hack3rcon]

No, I have not any hardware problems like cable or...
I will regenerate the hashes.
In your opinion, is OSFClone better for me?

[David (PassMark)]

I can only see 3 possibilities.
1) The "dd" command has been around since 1987. So maybe you found a bug in dd after 33 years. But this seems extremely unlikely.
2) Your hardware is special in some way. e.g. the BIOS is locked to to only use 1 model of hard drive
3) You have a hardware fault. Even if you think you don't.

[Hack3rcon]

I regenerate hashes and both of original and cloned SSD have same hashes:

Original:

Partition 0:
Size: 1.10 GB

SHA-1: 9c1c0c22b2d4eada6ee3044d8903cbece0e88fc4
MD5: e8a7840f01a0839d96f31646171a832b


Partition 1:
Size: 6.58 GB

SHA-1: a2128f780c7a0d22ad5dfb7fec7d5bd2e0f75dd8
MD5: e41bd2dc2ebb2aa7b0669f523234e3bf



Partition 2:
Size: 14.09 GB

SHA-1: 69cc89ec6a47ecc053c626afbcdb65b7130819c5
MD5: 716d8113743063a924d34411dd30ef27


Partition 3:
Size: 1.10 GB

SHA-1: 59aaf85e166ab503c0f64e3cf861f847d0c31241
MD5: 4e81c7d248e0f54a267b9253ff3f4182


Partition 4:
Size: 6.59 GB

SHA-1: ac0617096f320a4800c66aca0a88fd96237d546c
MD5: c31d194d32eeae8100ba6b346308af77


Partition 5:
Size: 82.33 GB

SHA-1: c3d0cf989c17cc8fae518ab8729df3d4f9599eb5
MD5: b779439080a8a19c6f38f99883d86d9a

Cloned:

Partition 0:
Size: 1.10 GB

SHA-1: 9c1c0c22b2d4eada6ee3044d8903cbece0e88fc4
MD5: e8a7840f01a0839d96f31646171a832b


Partition 1:
Size: 6.58 GB

SHA-1: a2128f780c7a0d22ad5dfb7fec7d5bd2e0f75dd8
MD5: e41bd2dc2ebb2aa7b0669f523234e3bf



Partition 2:
Size: 14.09 GB

SHA-1: 69cc89ec6a47ecc053c626afbcdb65b7130819c5
MD5: 716d8113743063a924d34411dd30ef27


Partition 3:
Size: 1.10 GB

SHA-1: 59aaf85e166ab503c0f64e3cf861f847d0c31241
MD5: 4e81c7d248e0f54a267b9253ff3f4182


Partition 4:
Size: 6.59 GB

SHA-1: ac0617096f320a4800c66aca0a88fd96237d546c
MD5: c31d194d32eeae8100ba6b346308af77


Partition 5:
Size: 82.33 GB

SHA-1: c3d0cf989c17cc8fae518ab8729df3d4f9599eb5
MD5: b779439080a8a19c6f38f99883d86d9a

As you see, SMART of both drives are OK.
I have two questions:
1- Why I can't remove DCO of the cloned drive?
2- Drives have same hashes, but why when I compare two volumes with "Hex Editor Neo" tool, then they are different?

[Hack3rcon]

DCO error:

[David (PassMark)]

Drives have same hashes, but why when I compare two volumes with "Hex Editor Neo" tool, then they are different?

Impossible. Your methodology must be flawed. Maybe hashing the same drive twice, or the drives aren't write protected and you are comparing the hex values after additional data has been written to them (after computing the hashes).

That DCO error was just saying that DCO can not be detected / altered on that drive.

[Hack3rcon]

It is odd for me too, but it is true.
BTW, as you see, both of SSD Drives are OK and doesn't have any hardware problem.
Why cloning not work?

[David (PassMark)]

Question has already been answered above.

[Hack3rcon]

Question has already been answered above.

Answered?
Do you like I record my screen and after it you will see that it is true and I cloned it properly, but not worked?

[David (PassMark)]

Yes answered.

1) The "dd" command has been around since 1987. So maybe you found a bug in dd after 33 years. But this seems extremely unlikely.
2) Your hardware is special in some way. e.g. the BIOS is locked to to only use 1 model of hard drive
3) You have a hardware fault. Even if you think you don't.

[Hack3rcon]

Yes answered.

Did you read my previous messages?
1- I used OSForensics for create this image and not "dd" tool.
2- Did you see the SMART screenshot of both SSD Drives? Both drives are OK.
3- MITEL BIOS?