Why can't I just dd an entire APFS disk? I've received a new Mac that has come preconfigured with lots of junk.
Naturally, my first order of business is to wipe the disk and clean install macOS. But first, I want to create a bit-perfect, bootable clone of the disk (which is formatted APFS Encrypted) and keep it on a flash drive, in the unlikely event that I ever need to boot into the original environment.
I tried to create this clone by booting the machine into Recovery mode, attaching a flash drive of the exact same capacity as the disk and running dd if=/dev/rdisk0 of=/dev/rdiskX bs=64k. I expected this to create an exact clone, especially reading at a raw level via /dev/rdisk. However, the resulting drive is not only unbootable, but none of the APFS structure is preserved - I'm left with an FDisk_partition_scheme partition type and a 0xEE volume.
Nothing in this answer proved useful in making this bootable.
More than &quot;how can I do this,&quot; I'm wondering &quot;why can't I do this.&quot;
Why doesn't dd perform the low-level, bit-by-bit replication that I'm looking for? Or, is it doing what I'm telling it to, but there's another factor at play that I'm not aware of?
I am going to go out on a limb and assume the OP's new Mac has a boot drive with a 4096 byte sector size and the flash drive has a 512 byte sector size. Using the dd command (as the OP has described) would result in a flash drive, where the Master Boot Record (MBR) partition table could be read, because this occurs in the same place regardless of sector size. This would be the first sector (also known as sector 0). However, the GUID Partition Table (GPT) starts at the beginning of the second sector (also known as sector 1). The second sector on the Mac boot drive has a byte offset of 4096. When you used the dd command, the GPT would be placed starting at byte offset 4096, but the actual location should have been at byte offset 512. The result is documented in the OP's question.
BTW, the same type of problem would occur with the backup (also known as the secondary) of the GPT stored at the end of the flash drive. Although, it would seem unlikely that Mac boot drive and the flash drive have exactly the same total size in bytes. I assume this is what the OP meant by the use of the phrase &quot;a flash drive of the exact same capacity as the disk&quot;.