I've picked up an HP Simplesave external drive. It comes with some fancy software that is of no use to me because I don't use Windows. Like many current consumer-targeted backup drives, the backup software is actually contained on the drive itself. I'd like to save the drive's initial state so that I can restore it if I decide to sell it.
The backup box itself is somewhat customized: in addition to the hard drive device, it presents a CDROM-like device on /dev/sr0. I gather that the purpose of this cdrom device is to bootstrap via Windows autoplay the backup application which lives on the disk itself. I wouldn't suppose any guarantees about how it does this, so it seems important to preserve the exact state of the disk.
The drive is formatted with a single 500GB NTFS partition.
My initial thought was to use dd to dump the disk (/dev/sdb) itself, but this proved impractical, as the resulting file was not sparse. This seemed to be because the NTFS empty space is not filled with zeroes, but with a repeating series of 16 bytes.
I tried gzipping the output of dd. This reduced to the file to a manageable size — the first 18GB was compressed to 81MB, versus 47MB to tarball the contents of the mounted filesystem — but it was very slow on my admittedly somewhat derelict Pentium M processor. The time to do that first 18GB was about 30 minutes.
So I've resorted to dumping the disk state and partition data separately.
I've dumped the partition state with
sfdisk -d /dev/sdb > sfdisk.-d.out
I've also created a compressed image of the NTFS partition (the only one on the disk) with
ntfsclone --save-image --output - /dev/sdb1 | gzip -c > ntfsclone.img.gz
Is there anything else I should do to ensure that I can restore the precise original state of the drive?
