Use dd to image a disk

“dd” is the linux command for taking byte by byte copies of files. Since a hard disk behaves sort of like a big file in linux, we can use “dd” to take a copy or image.

It is a good idea to zero all free space on the original disk before taking the image. This will make the empty space easier to compress. So if possible, mount the original disk, cd onto it and run the following commands to create file to fill the remaining hard disk space with zeros, you can then delete the file.

# dd if=/dev/zero of=delete.me bs=8M
# rm delete.me

Then to take the image of a disk detected as /dev/sda

# dd if=/dev/sda conv=sync,noerror bs=64K | gzip -c  > sda-dd-image.gz

You could have omitted the gzip bit to create an uncompressed image.

# dd if=/dev/sda conv=sync,noerror bs=64K of=sda-dd-image.nozip

To check your progress, you can open another terminal and send the dd process a kill -USR1 signal.

# watch -n 10 killall -USR1 dd

To check or verify your copy, use MD5

# dd if=/dev/sda bs=64K | md5sum

and compare the checksum to

# cat sda-dd-image.nozip | md5sum

or

# gunzip -c sda-dd-image.gz | md5sum

To restore, use

# gunzip -c sda-dd-image.gz | dd of=/dev/sda conv=sync,noerror bs=64K

Or if you are restoring from an uncompressed image

# dd if=image.dd of=/dev/sda conv=sync,noerror bs=64K

You can also mount an uncompressed image without restoring it back to a drive. There is a little bit of maths to figure out where the partition starts.

First run fdisk on your disk image

# fdisk -l -u -C 592 /media/sdb1/image.dd

Disk /media/sdb1/image.dd: 80.0 GB, 80026361856 bytes
255 heads, 63 sectors/track, 9729 cylinders, total 156301488 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xb1579d08
Device                Boot Start End       Blocks    Id System
/media/sdb1/image.dd1 *    63    156280319 78140128+ 7  HPFS/NTFS/exFAT

This shows that the partition we are interested in starts at sector 63. So multiply by 512 bytes per sector, our partition starts at byte 32256.
Make a folder to mount the image on, and then mount it as follows

# mkdir /media/loop
# mount -o loop,offset=32256 -t ntfs /media/sdb1/image.dd /media/loop

Check all is present with

# df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda1             78140128   3895592  74244536   5% /media/sda1
/dev/sdb1            1442145212 1368096272    792140 100% /media/sdb1
/dev/loop2            78140128   5566440  72573688   8% /media/loop