{"id":97,"date":"2022-07-14T16:18:23","date_gmt":"2022-07-14T16:18:23","guid":{"rendered":"https:\/\/brainlessideas.com\/?p=97"},"modified":"2022-07-15T14:32:05","modified_gmt":"2022-07-15T14:32:05","slug":"use-dd-to-image-a-disk","status":"publish","type":"post","link":"https:\/\/brainlessideas.com\/index.php\/2022\/07\/14\/use-dd-to-image-a-disk\/","title":{"rendered":"Use dd to image a disk"},"content":{"rendered":"\n<p>\u201cdd\u201d is the linux command for taking byte by byte copies of files. Since a hard disk behaves sort of like a big file in linux, we can use \u201cdd\u201d to take a copy or image.<\/p>\n\n\n\n<p>It is a good idea to zero all free space on the original disk before taking the image. This will make the empty space easier to compress. So if possible, mount the original disk, cd onto it and run the following commands to create file to fill the remaining hard disk space with zeros, you can then delete the file.<\/p>\n\n\n\n<!--more-->\n\n\n\n<pre class=\"wp-block-preformatted\"># dd if=\/dev\/zero of=delete.me bs=8M\n# rm delete.me<\/pre>\n\n\n\n<p>Then to take the image of a disk detected as \/dev\/sda<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># dd if=\/dev\/sda conv=sync,noerror bs=64K | gzip -c  &gt; sda-dd-image.gz<\/pre>\n\n\n\n<p>You could have omitted the gzip bit to create an uncompressed image.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># dd if=\/dev\/sda conv=sync,noerror bs=64K of=sda-dd-image.nozip<\/pre>\n\n\n\n<p>To check your progress, you can open another terminal and send the dd process a kill -USR1 signal.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># watch -n 10 killall -USR1 dd<\/pre>\n\n\n\n<p>To check or verify your copy, use MD5<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># dd if=\/dev\/sda bs=64K | md5sum<\/pre>\n\n\n\n<p>and compare the checksum to<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># cat sda-dd-image.nozip | md5sum<\/pre>\n\n\n\n<p>or<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># gunzip -c sda-dd-image.gz | md5sum<\/pre>\n\n\n\n<p>To restore, use<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># gunzip -c sda-dd-image.gz | dd of=\/dev\/sda conv=sync,noerror bs=64K<\/pre>\n\n\n\n<p>Or if you are restoring from an uncompressed image<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># dd if=image.dd of=\/dev\/sda conv=sync,noerror bs=64K<\/pre>\n\n\n\n<p>You can also mount an uncompressed image without restoring it back to a drive. There is a little bit of maths to figure out where the partition starts.<\/p>\n\n\n\n<p>First run fdisk on your disk image<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># fdisk -l -u -C 592 \/media\/sdb1\/image.dd\n\nDisk \/media\/sdb1\/image.dd: 80.0 GB, 80026361856 bytes\n255 heads, 63 sectors\/track, 9729 cylinders, total 156301488 sectors\nUnits = sectors of 1 * 512 = 512 bytes\nSector size (logical\/physical): 512 bytes \/ 512 bytes\nI\/O size (minimum\/optimal): 512 bytes \/ 512 bytes\nDisk identifier: 0xb1579d08\nDevice                Boot Start End       Blocks    Id System\n\/media\/sdb1\/image.dd1 *    63    156280319 78140128+ 7  HPFS\/NTFS\/exFAT<\/pre>\n\n\n\n<p>This shows that the partition we are interested in starts at sector 63. So multiply by 512 bytes per sector, our partition starts at byte 32256.<br>Make a folder to mount the image on, and then mount it as follows<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># mkdir \/media\/loop\n# mount -o loop,offset=32256 -t ntfs \/media\/sdb1\/image.dd \/media\/loop<\/pre>\n\n\n\n<p>Check all is present with<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># df\nFilesystem           1K-blocks      Used Available Use% Mounted on\n\/dev\/sda1             78140128   3895592  74244536   5% \/media\/sda1\n\/dev\/sdb1            1442145212 1368096272    792140 100% \/media\/sdb1\n\/dev\/loop2            78140128   5566440  72573688   8% \/media\/loop<\/pre>\n","protected":false},"excerpt":{"rendered":"\n<p>\u201cdd\u201d is the linux command for taking byte by byte copies of files. Since a hard disk behaves sort of like a big file in linux, we can use \u201cdd\u201d to take a copy or image.<\/p>\n<p>It is a good idea to zero all free space on the original disk before taking the image. [&#8230;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[2,10],"tags":[],"class_list":["post-97","post","type-post","status-publish","format-standard","hentry","category-it","category-linuxses","odd"],"_links":{"self":[{"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/posts\/97","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/comments?post=97"}],"version-history":[{"count":2,"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/posts\/97\/revisions"}],"predecessor-version":[{"id":118,"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/posts\/97\/revisions\/118"}],"wp:attachment":[{"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/media?parent=97"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/categories?post=97"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/brainlessideas.com\/index.php\/wp-json\/wp\/v2\/tags?post=97"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}