As a reverse of my Floppy Disk Resume post, I show how to take an image of a 3.5” high-density floppy disk.
Multiple times, I’ve been approached by people to investigate floppy disks they have. I’m making a quick post to share how to do that, and to document my steps as a reminder to myself.
I don’t know if this is the “right” way if you really want to get forensic with it, but my thoughts on how to do it are take an image of the entire disk to preserve it, then you can mount that copy or do whatever you want without further risk to the real disk itself.
First, I’d find the device. After I plug in my USB floppy drive,
dmesg should say which device it is under
/dev/. Then I copy the disk to an image file with
dd. I use
status=progress to know it’s still working because it can take some time, just note I don’t think that works with all versions of the command.
sudo dd if=/dev/sdf of=~/Documents/floppydiskimage status=progress
This creates the image file
floppydiskimage. I left off a file extension because it doesn’t really matter, but it matters to some other programs and they get confused, so just left it off.
You can then see the image file you have.
$ file ~/Documents/floppydiskimage /home/eric/Documents/floppydiskimage: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "1^1^4IHC" cached by Windows 9M, root entries 224, sectors 2880 (volumes <=32 MB), sectors/FAT 9, sectors/track 18, reserved 0x1, dos < 4.0 BootSector (0x0), FAT (12 bit by descriptor+sectors), followed by FAT
Then you create a directory and mount the image to it. You can then explore the contents.
sudo mkdir /mnt/floppyimage sudo mount ~/Documents/floppydiskimage /mnt/floppyimage ls /mnt/floppyimage/
This is of course for disks that are still intact enough to have a file system. I’m pretty sure this method copies all the bytes regardless, so if the file system on the disk is bad you can look into other software tools to investigate. You’ll need to find different readers for different disks, like 5.25” floppies, but if they show up the same as this, this method should still work. If you really want to get into it even more, look into reading the “flux” of disks, the actual magnetic fields stored on disks.