dd, the Mac OS X (Unix) native solution to hard drive testing, cloning, drive recovery ...

App.net’s gaelicwizard posted this approach to hard drive testing back in Oct 2013. I’d lost it for a while but just found it again today:

$ dd if=/dev/disk1s2 of=/dev/null If it hangs indefinitely, replace the hard drive. If it I/O Error’s, replace the the hard drive. If it completes without problem, the hard drive has no bad blocks.

I’ve not seen this mentioned anywhere else recently, but I found a related MacOS X Hint from 2005 that explains what dd is, and how it can be used for drive recovery and as an alternative to “Norton Ghost”:

The Unix program dd is a disk copying util that you can use at the command line in order to make a disk image. It makes a bit-by-bit copy of the drive it's copying, caring nothing about filesystem type, files, or anything else. It's a great way to workaround the need for Norton Ghost.

Normally, in order to make a disk image, the disk you're copying from has to be able to spin up and talk -- in other words, it's OK to make a copy if the disk is healthy. But what happens when your disk is becoming a doorstop? As long as it continues to spin, even with physical damage on the drive, dd and Mac OS X will get you out of the fire.

We had a situation recently where a friend sent a disk to us that had hard physical errors on it. It would boot in Windows, but then it would hit one of these scratch marks and just die. We fired up dd, and it started OK, but stopped at the same physical error location -- complaining about a Hard Error.

So the workaround was to designate the dd mode as noerror -- which just slides over the hard stops, and to add the mode sync, which fills the image with nulls at that point. We did it on BSD Unix, but as long as you can get the hard drive attached to your Mac, the command is the same:

dd bs=512 if=/dev/rXX# of=/some_dir/foo.dmg conv=noerror,sync

… Once you’ve established the disk image (in this example, foo.dmg), you're almost home. Here's where your Mac OS X box is far and away the best thing to have. In this example, the dd output file is foo.dmg. You have to realize that this is an exact copy of a busted drive, but the "holes" are filled with nulls. As long as the damage isn’t to the boot sector, though, when you double-click on it, Mac OS X mounts it without breathing hard … who cares if it's FAT32, NTFS, whatever...

On a Mac or Unix machine “man dd” will provide the explanations of the parameters in @gaelicwizard’s example:

• if=file Read input from file instead of the standard input.
• of=file  Write output to file instead of the standard output. 

So the command reads every byte of disk1s2 and writes it to “null” (Nowhere). Why disk1s2? It’s a common boot drive. You can use “diskutil list” to find out the name of attached drives. On my machine the result looks like:

/dev/disk0
 #: TYPE NAME SIZE IDENTIFIER
 0: GUID_partition_scheme *1.0 TB disk0
 1: EFI EFI 209.7 MB disk0s1
 2: Apple_HFS Stanford 999.3 GB disk0s2
 3: Apple_Boot Recovery HD 650.0 MB disk0s3
/dev/disk1
 #: TYPE NAME SIZE IDENTIFIER
 0: GUID_partition_scheme *2.0 TB disk1
 1: EFI EFI 209.7 MB disk1s1
 2: Apple_HFS Media 2.0 TB disk1s2
/dev/disk2
 #: TYPE NAME SIZE IDENTIFIER
 0: GUID_partition_scheme *3.0 TB disk2
 1: EFI EFI 209.7 MB disk2s1
 2: Apple_CoreStorage 3.0 TB disk2s2
 3: Apple_Boot Boot OS X 134.2 MB disk2s3
/dev/disk3
 #: TYPE NAME SIZE IDENTIFIER
 0: confidential *102.4 MB disk3
/dev/disk4
 #: TYPE NAME SIZE IDENTIFIER
 0: Apple_HFS BACKUP_B *3.0 TB disk4

I tested dd on disk4 (my backup disk). I found I had to run from my admin account, I needed to use sudo, and I had to unmount the drive first (or I got “resource busy” error message):

Admin$ sudo dd if=/dev/disk4 of=/dev/null

Please be careful what you type — especially for the of parameter. One little typo and you could be writing data anywhere.

It runs silently, you can stop with a Ctrl-C. It then reported:

1451352+0 records in

1451352+0 records out

743092224 bytes transferred in 48.218709 secs (15410869 bytes/sec)

I’ll let this run overnight on one of my backup drives some time, but it looks like an inexpensive way to test a hard drive. I’m surprised it’s not described more frequently. gaelicwizard knows the dark arts.