How to create an accurate byte-level copy of an SSD to another drive?

TL;DR I need to recover lost files from an SSD but don't have the time to do it right now. How can I clone an SSD to another drive on byte level, including drive areas which the OS thinks are free?

I did a cut and paste (Comd+C then Comd+Opt+V) on my Mac 10.14’s Finder to move some .mov files from my internal SSD to my WD My Passport External Harddrive (connected by USB 3.0 with a USB-C to USB adapter. My 15-inch Macbook is the 2018 version which only has USB-C ports, and has the touch bar).

Alas, after a while, I move my Macbook and the connected got unstable, and was eventually lost. To my horror, when I tried to do a transfer again, I see that some files are greyed out on my external WD harddrive (see screenshot), and these files are no more on the original folder on my internal SSD!

I tried to recover these files by using the following software on my SSD (**but not on the external hard drive yet) to no avail: Disk Drill File Salvage EaseUS Data Recovery Techtool Pro 11

**I ran the software immediately after discovering the issue, because I know that if I continued using the Macbook, there would be risk that the OS would overwrite my files.

Can someone tell me:

(a) I am so tired of doing all this recovery, and want to move on to something else. But I need to use my Macbook! If I use it, I will definitely overwrite the lost files’ bytes one day. Can I do a byte-for-byte clone of the SSD to somewhere and work on this recovery issue some other time?

(b) If yes, what software should I use and how do I make sure that the clone is both byte-for-byte AND it includes the parts of the SSD that are now seen by the OS as “free” (since that’s probably where the lost files reside?)

(c) For (b), prefer software that can also show me the bytes in hexadecimal so I can inspect manually to see if it’s really byte for byte.

P.S.: For more context, see: Data loss due to lost connection when transferring from Mac 10.14 SSD to External HDD

P.S.: the SSD I am looking to clone is 256GB

Solution 1:

My favorite tool for that is the "dd" command that comes with macOS. It needs to be used from the Terminal, so if that puts you off - there are also GUI alternatives.

"dd" is quite simple and will copy all data - including "free" areas. You take a clone by first rebooting your computer into Recovery mode.

Then mount an external drive where you want to store the backup - make sure it has enough free space to contain the full size of the original drive.

Open Disk Utility to find the device name of your original drive. This is probably something like /dev/disk1s1 or similar. Also, if your original drive has been mounted for some reason while in Recovery mode - unmount it from Disk Utility.

Then open Terminal and run a command like this:

dd if=/dev/rdisk1s1 of=/Volumes/ExternalDrive/clone.img bs=1m

Note that I put an "r" in front of disk1s1 - this bypasses buffers to make the transfer faster.

Also note that the output file name is specified as /Volumes/ExternalDrive/clone.img. You'll want to replace "ExternalDrive" with the name of your own externally connected drive.

The last part of the command bs=1m means to copy in block sizes of 1 megabyte. This just speeds up the operation.