The case of the frustrating MacBook imaging

A quick post today. I recently had to image a few of the newer MacBooks (late 2015) that only have one USB Type C port. This is a challenge. I have a USB non-powered Type C hub that has four USB 3.1 ports on it. To acquire an image of the drive you are limited, as the NVMe drivers for the new internal SSD drive are not working in the current versions of any Linux distro (at the time when I was creating the images). I believe that kernel version 4.3-rc3 will work with some tweaking, but as of the time of this posting I have not verified if there is support for these internal drives. For now I've detailed the process I used below. I was under a time crunch, but I believe the process to be sound and reproducible. The next time I have to create an image of one of these *wonderful* devices I will certainly be trying the excellent boot disk Paladin from Sumuri: https://www.sumuri.com/product-category/paladin/ The crew at Sumuri are absolutely the best, please support them whenever you are able!

Process:

1. Plug in the USB hub with a ExFat formatted external USB 3 hard drive to contain the image.
2. Power on the fully charged MacBook and press Command-R while it turns on. This is the recovery mode (typically used for repairing the OS).
3. Once booted click on Utilities → Terminal.
4. At the terminal window use the command diskutil list to identify the boot disk and the intended destination disk.
1. The boot disk may show up as /dev/disk2 but, there is a RAW version of this called /dev/rdisk2. If you don’t use dd on the RAW version of the disk it will take days to image as the /dev/disk2 is presented by the underlying OS.
5. Unmount the internal SSD by running diskutil unmount /dev/diskX
6. Mount your destination partition by running diskutil mount /dev/disk4s1 (depends on where it shows up under the list).
7. Use the built in dd command to start the process. Ex: dd if=/dev/rdisk2 of=/Volume/image/macbook.raw bs=8192 conv=noerror
8. To prevent the MacBook from sleeping use the built in caffeinate command: caffeinate -u -t 3600   (don't sleep for an hour)
9. To check on the status of the image size, use this simple FOR loop: while : ; do ls -l /Volume/image/ ; sleep 1 ; clear ; done
10. To create an md5 hash of the imaged drive use this command: md5 /dev/rdisk2 > /Volume/image/macbook.md5 (Perform this AFTER the imaging is complete, otherwise the system may lock up)