Obtain an offline image of an Xserve disk

Question

We have an Intel Xserve with Mac OS X 10.4. It seems to have been infected by a virus.

We want to obtain the disk image without booting into the OS. Preferably, we would want to boot via a USB disk or dongle.

Any suggestions?

Answer 1

There are several options, depending on what resources you have available:

1. If you have the OS install DVD, you can boot from that (insert the DVD, then either hold the "C" key at startup, or hold Option key and select the DVD in the startup manager). There's a "Utilities" menu in the installer that'll let you run Disk Utility, which can either create a disk image from the volume (from the File menu choose New > Disk Image from Folder, then select the entire volume as the "folder" to image), or clone the volume to another disk (use the Restore tab, drag the relevant volumes from the sidebar into the Source and Destination fields, and be sure to select Erase Destination).
2. You could use a linux boot disk (optical or USB); pick an appropriate distro for your model (is it an Intel or PowerPC Xserve?), create the disk on another computer, and use the Option key to select it at startup. Note that linux doesn't (normally) support the HFS+ filesystem OS X uses, but you can still to raw image cloning with dd.
3. If you have another computer with FireWire available, you can put the Xserve in target disk mode (start with the "T" key held down), and it'll basically turn itself into an external FireDire drive. Connect it to the other computer, and use whatever cloning/imaging tools that supports (see above). Note: if your Xserve has a RAID card, I'm not sure target mode supports that.