How do i take an image of an uninitialized drive?

Is this a USB stick or a USB SSD?

Some of the SanDisk SSDs have a known firmware issue where data can disappear from the SSD. There is a firmware update for the SSD which is supposed to fix things, but even after the SSD firmware update there have been reports of the issue. In fact the WD/SanDisk support page makes no mention of the data loss and it is believed other WD & SanDisk SSDs besides those listed in the support document could be affected.

https://support-en.wd.com/app/firmwareupdate

Here is an article about the issue:

https://arstechnica.com/gadgets/2023/05/sandisk-extreme-ssds-keep-abruptly-failing-firmware-fix-for-only-some-promised/

https://arstechnica.com/gadgets/2023/08/sandisk-extreme-ssds-are-still-wiping-data-after-firmware-fix-users-say/

Unfortunately I don't know whether the data can be recovered even after applying the firmware update. I vaguely recall someone may have mentioned they were somehow able to access their data again. It is a possibility that they were using an exFAT or NTFS volume and connected it to a Windows system.

As for imaging the drive block by block (or bit for bit), you can do that using the command line, but it can be risky if you make a mistake. You would need to use the command "dd" which has been call "Disk Destroyer" or "Data Destroyer". Here is the template of the command to use:

sudo  dd  if=/dev/diskX   of=<path-to-raw-image-file>   bs=4m

You need to replace "diskX" with the correct identifier for the SanDisk drive which can be found in Disk Utility. You will need to replace "<path-to-raw-image-file>" with the correct path to where you want the image to be stored including giving it a file name (I like to name them with the file extension .img). It is easiest if the path & file name involved do not have any spaces in them (especially if you are not familiar with the command line). I am guessing on using a block size (bs) of 4MB here as it can affect the speed of the reads from the SSD (should be a multiple of 4k or 1MB).

The other downside of using "dd" to perform a bit for bit image is that once started, it must finish or you will need to restart the process from the very beginning since there is no resume feature & no way to monitor the progress. Even with an SSD, this process could take a long time plus it is also dependent on the speed of the destination media which will house the raw image file created.

There is a better Linux command line utility available (an enhanced "dd") which will show the progress, handle any errors, and also allow the process to be stopped & restarted at the last point. However, there is no precompiled version of it for macOS although it is possible to acquire it (risky since that method could create problems with macOS).

I am not aware of any macOS GUI apps which will perform the bit for bit (block by block) image. Perhaps there is one for Windows (I never looked since I prefer the other better command line tool available in Linux).

You can take a look at the raw data that will be read from the SanDisk disk by using the following command (the output will scroll by quickly). There may be lots of zeroes even on a good drive, but usually if there is data on the drive, then you should occasionally see some non-zero items scroll by. Much a drive tends to be empty unless the drive is nearly full.

sudo  xxd  /dev/diskX

Again, you need to replace "diskX" with the proper drive identifier for the SanDisk drive.

Both of these commands will ask for you admin password. Nothing will appear on the screen as you type the password so you will need to press the "Return" key to submit the password.

I may not be able to help much more than this due to some personal matters that may need my attention.

If the system cannot read the disk there is no way to copy or image it. You will have to rely on a data recovery solution or vendor. Also understand that the likelihood of recovery from a flash drive is small.

Here is WD/Sandisk's information about recovery services & apps:

https://support-en.wd.com/app/answers/detailweb/a_id/37605/~/usb-drive-%26-memory-card-data-recovery-options

Uninitialized means the drive has not been prepared for data storage on the Mac. It needs to be formatted properly for use on your computer. You can use Disk Utility app to format that USB drive.

Erase and reformat a storage device in Disk Utility on Mac - Apple Support

It is possible the drive has been formatted for use by a Windows PC, but the Mac may not recognize that format. NTFS is a PC format the Mac does not recognize. A drive with NTFS formatting would be consider uninitialized by the Mac even though it does actually contain data from a PC.

If you believe there is data on that USB drive that needs to be accessed, then you should contact whomever gave you that drive and see if the data can be provided another way. Mac can access data on a FAT formatted drive from a PC.

If this is a new USB drive, then you must format it properly. See the link above.

Use Disk Utility to format it with the APFS format and a GUID partition scheme, giving the drive whatever name you like.

After that, you can store images on it by clicking and dragging an image file onto the drive icon or by using other means in the Mac's Finder.

Organize your files in the Finder on Mac - Apple Support

If the Mac believes this is an uninitialized drive with no data on it, then there is no drive "image" to take, no image for the Mac to save.

You can create a disk image using Disk Utility app. This document has info and guidance for that:

Create a disk image using Disk Utility on Mac - Apple Support

jjjefff wrote:

Is it possible to create a sector-by-sector drive image, regardless of the drive formatting?

I don't know the answer to that, but I suspect an image cannot be made of a drive which has an unidentified format structure, at least not with Disk Utility.

I will defer to more knowledgable users here in the community for that information.

May I ask what your end goal is regarding this drive?

We're working in the dark here.

Exactly what drive is it (make & model)?

What is its format?

How is it connected to your Mac?

Presumably there is data on the drive or you would not have any reason to want to image it. Where/how was the drive used before? What is the reason for imaging it?