I had a case where a clients MacBook Pro was filled with so much crap and corrupted files that when booted to the OS it would stay stable for about 5-10 minutes before totally freezing. I had to get a full backup of the whole hard drive and I didn’t want to take out the HD itself. And no, I didn’t have a FireWire cable if you’re thinking about booting in to the target disk mode. If you’re lucky and you own a FireWire cable booting to the target disk mode is probably the easiest method.

I should probably state at this point that this “tutorial” is intended for Macs. The commands aren’t exactly the same in Linux but not that far away. By googling a bit you can probably figure it out by your self. Now lets continue.

I thought it would be the easiest to boot in single-user mode, then mount the USB drive and sync the whole HD to the external drive. As this process took me a few hours before I got it working I decided to write this blog post so that maybe someone else can benefit from my errors too.

I assume you’ve prepared an empty USB dive and the computer you want to backup from is turned off. Now, lets jump in.

Attach your empty USB drive to the Mac and start it up holding down the keys CMD+S until it boots to single user mode. You should now see a command prompt stating root right before the blinking cursor. Type in our first command.

/sbin/mount -uw /

The -u flag indicates that the status of an already mounted file system should be changed and the -w flag tells the system to mount the file system in read-write mode.

/sbin/fsck -fy

If your drive has suffered a lot and has corrupted files it’s good to run a disc check before backing up. If you’re lucky it might even fix something. The code above runs filesystem consistency check and interactive repair. The -f flag forces fsck to check `clean’ filesystems when preening and the -y flag makes it assume a yes response to all questions asked by the fsck itself; this should be used with great caution as this is a free license to continue after essentially unlimited trouble has been encountered.

After the fsck has finished we’ll have to create a mount point for out USB drive.

mkdir /Volumes/usbdrive

So, the command above makes a new directory called “usbdrive” to the /Volumes/ directory. This is the path where we’ll mount our drive. The name of the directory is up to you. Without further ado, lets mount our drive.

/sbin/mount_hfs /dev/disk1s2 /Volumes/usbdrive

The /sbin/ directory contains a few ready made mount scripts / programs. I’m using the mount_hfs as my usb drive has been formatted to use Mac OS Extended (Journaled). A few different mounting options can be found from the directory for different filesystems. Run a “ls /sbin/ | grep mount_” command to list all the different mounting options. The second part of the command “/dev/disk1s2” tells the computer which disk to mount to the share point (last part of the command “/Volumes/usbdrive”). If you have a laptop like me it usually has only one internal disk that is mapped to name disk0. When I connect a usb drive it’s mapped to disk1. As I’ve said this depends of the disks and partitions you have connected to your computer. To mount a disk with just one partition use the last sub-name of the disk. In my case it’s disk1s2. You can list all the disk connected to your computer with command “ls /dev/ | grep disk”.

After the mount has been performed we can finally start the sync. If you’re smart and cautious you’ll first try to create a single file to the mounted drive and then check that you’ve really mounted the correct drive. For example you could create a text file using “vi” or “nano” to the share points path, unmount the drive, connect it to another computer and see if the file has really been saved to the drive as intended and then quickly do the steps again to get back to this point.

rsync -av /* /Volumes/usbdrive

Now, the final command starts the sync. You could use a “cp” command but I prefer to use the “rsync”. The command above copies the whole contents of the internal drive to the usbdrive. The -a flag is a quick way of saying you want recursion and want to preserve almost everything. The -v flag stands for verbose which means the app will list all the stuff it’s doing.

Sources: