How to Image and Verify a FreeDOS Disk Before Repairing It

Filesystem repair writes new metadata. On aging DOS media, that can overwrite directory entries, FAT chains, deleted-file remnants, or a marginal sector that was readable only once. Create and verify a sector-level image before running CHKDSK /F, FDISK, SYS, FORMAT, or an undelete tool against the original.

Stabilize identity and write protection

Photograph labels and cabling. Record media type, capacity, drive/controller, hardware write-protect state, partition table, reported geometry, and every read error. For a floppy, engage its physical write-protect tab. For hard disks, use a trusted hardware write blocker when forensic integrity matters.

Do not mount the source read-write on a modern host. Disable automount or use a dedicated acquisition environment. A host may update volume metadata merely because it recognizes FAT.

Use FreeDOS DISKCOPY for ordinary floppy images

FreeDOS DISKCOPY can copy a floppy to a raw image file:

DISKCOPY A: D:\IMAGES\DISK01.IMG /V

Store the image on a different healthy drive. Do not write the destination image onto the source floppy. Avoid /F when preservation requires a sector-for-sector image: the fast option copies only filled sectors and the documentation explicitly says the resulting image is not identical to the original medium.

/R enables DISKCOPY’s error-recovery mode where compiled/supported. Preserve its messages and do not assume unreadable sectors contain zeros. A recovery image with substituted data needs a map or log identifying every uncertain region.

Image failing hard disks from a host designed for recovery

For a hard disk or severely damaged floppy, GNU ddrescue on a Unix-like acquisition host records which regions succeeded and retries difficult areas without rereading good data unnecessarily:

ddrescue -f -n /dev/source disk.img disk.map
ddrescue -d -r3 /dev/source disk.img disk.map

Those device names are placeholders. Reverse source and destination and the original is destroyed. First verify serial, size, write blocker, destination free space, and a second operator’s review. Keep the mapfile with the image; it is part of the evidence.

If the drive clicks, disappears, overheats, or accumulates errors rapidly, stop. Repeated DIY power cycles can worsen mechanical damage; professional recovery may be the only responsible path.

Hash the image and its copies

Compute a modern checksum on the acquisition host:

sha256sum disk.img > disk.img.sha256
sha256sum -c disk.img.sha256

FreeDOS’s MD5SUM utility may support MD5, SHA, SHA-256, or other modes depending on how it was compiled. Query MD5SUM /? and record the algorithm:

MD5SUM /M:SHA256 /V DISK01.IMG > DISK01.SHA

MD5 remains useful for accidental-error detection but is not collision-resistant against an adversary. Use SHA-256 on a capable host for evidentiary integrity and store manifests separately from the working copy.

Make two acquisitions when media permits

Two reads with identical hashes provide strong evidence of a stable acquisition. If hashes differ, compare the read logs and sector ranges; do not choose one silently. Marginal magnetic media can return inconsistent bytes without a hard error.

Preserve the first-pass image before additional retries. A later “better” image may recover more sectors while changing others. Name images by media ID, pass, date, tool, and mapfile rather than final.img.

Repair only a duplicate

Clone the image and attach the copy to an emulator or loop device read-only first. Inventory partitions, boot sector, backup boot sector, FAT copies, directories, and recoverable files. Run repair tools only on a disposable derivative:

cp --reflink=auto disk.img disk-working.img

Keep the original acquisition immutable. Export recovered files to a separate destination and hash them. Test boot in an emulator with matching geometry, but remember that successful boot does not validate every sector or file.

A useful evidence set contains photographs, hardware identity, acquisition commands, tool versions, hashes, read-error map, untouched image, working copy, and recovery notes. Imaging is complete when another operator can prove which bytes came from the source and which were introduced by repair.

Related:

Sources: