Balena Etcher - clone drive, now have two blank drives

balenaEtcher
44

Hello @harderased

Do you know how many partitions were on the drive ?
Were they fat32 or ntfs partitions ?
How large is that drive ?

I’ll assume that there was only one partition and that you have enough disk space on your mac to make a disk image of this drive.
The partition table is missing on that drive, so we need to find where the partition is.
If the drive was readable on Windows 7, I guess the partition is either fat32 or ntfs.

Do not format this drive if any system asks you to !

In order to recover data (on a mac):

Step 1: Find the offset of the partition

  • before connecting the drive, open a terminal on your mac and type diskutil list
  • connect the drive to your mac, if macOS tells you something like “this drive is not readable on this computer”, select “ignore”, DO NOT SELECT FORMAT;
  • run diskutil list again, a new drive should have appeared, note its name (something like /dev/disk2);
  • I will use /dev/disk2 in the commands below, please use the correct disk number from the previous step;
  • run sudo hexdump -C -s 512 /dev/disk2 | head which will show you the contents of the beginning of the disk (skipping the first 512 bytes).

You should see something like:

00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00100000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|
00100010  00 00 00 00 00 f8 00 00  3f 00 ff 00 00 08 00 00  |........?.......|
00100020  00 00 00 00 80 00 00 00  ff 17 b7 03 00 00 00 00  |................|
00100030  00 00 0c 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|
00100040  f6 00 00 00 01 00 00 00  31 0c 76 f0 2d 76 f0 9e  |........1.v.-v..|
00100050  00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb 68 c0 07  |.....3.....|.h..|
00100060  1f 1e 68 66 00 cb 88 16  0e 00 66 81 3e 03 00 4e  |..hf......f.>..N|
00100070  54 46 53 75 15 b4 41 bb  aa 55 cd 13 72 0c 81 fb  |TFSu..A..U..r...|

If you see the .R.NTFS on the third line of the output, this is an NTFS partition starting at 0x00100000 bytes (the number in the first column of the third line)= 1048576 bytes = 1MiB.

Another possible output would be

00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00100000  eb 58 90 4d 53 44 4f 53  35 2e 30 00 02 20 2c 09  |.X.MSDOS5.0.. ,.|
00100010  02 00 00 00 00 f8 00 00  3f 00 ff 00 00 08 00 00  |........?.......|
00100020  00 18 b7 03 6a 3b 00 00  00 00 00 00 02 00 00 00  |....j;..........|
00100030  01 00 06 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100040  80 00 29 24 bf 89 6e 4e  4f 20 4e 41 4d 45 20 20  |..)$..nNO NAME  |
00100050  20 20 46 41 54 33 32 20  20 20 33 c9 8e d1 bc f4  |  FAT32   3.....|
00100060  7b 8e c1 8e d9 bd 00 7c  88 56 40 88 4e 02 8a 56  |{......|.V@.N..V|
00100070  40 b4 41 bb aa 55 cd 13  72 10 81 fb 55 aa 75 0a  |@.A..U..r...U.u.|

If you see the .X.MSDOS5 on the third line of the output, this is a FAT32 partition starting at 0x00100000 bytes (the number in the first column of the third line) = 1048576 bytes = 1MiB.

We don’t really care what type of partition (fat32 or ntfs) it is, what we need is the offset: the number in the first column, 00100000 in both cases above. This is an hexadecimal number. So 0x00100000 = 1048576 = 1MiB

Step 2: Backup the partition

Copy the raw partition to a disk image with sudo dd if=/dev/rdisk2 of=copy.img bs=1048576 skip=1 (replace rdisk2 with the number of the disk from the previous steps and note the r before disk), this will take some time depending on the size of the drive.

Detail:

  • if=: input file;
  • /dev/rdisk2: the disk from the steps above, rdisk instead of disk will copy faster;
  • of=: output file;
  • bs=1048576: tells dd to copy 1MiB sized blocks;
  • skip=1: tells dd to skip one block at the beginning (which size is defined by bs= above) because out partition starts at 1MiB. This is the most important part, you need to adapt it according to the partition offset you’ve found in step1.

Now you should have a copy of the raw partition as copy.img in your home folder.

Step 3: Mount the partition

That’s the easy part: hdiutil attach copy.img

You should now see a new “drive” on your desktop, this is your partition.