LearnLinux › LearnLinux › CMDS

💾 DD Command

Low-Level Data Copy and Conversion Utility

Overview

The dd command (derived from "data duplicator" or "disk dump") is a powerful low-level utility for copying and converting raw data. It operates at the block level, making it essential for creating disk images, backing up boot sectors, wiping drives, and performing raw data operations. Unlike regular copy commands, dd works with direct device access and can handle special files, making it both powerful and dangerous if misused.

⚠️ CRITICAL WARNING: The dd command can instantly destroy data if used incorrectly. Always double-check your if= (input) and of= (output) parameters. A single mistake can overwrite your entire disk. Triple-check before pressing Enter!

1Create a Backup Image of a Disk

$ sudo dd if=/dev/sda of=/backup/sda.img bs=4M status=progress
2147483648 bytes (2.1 GB, 2.0 GiB) copied, 45 s, 47.7 MB/s
4294967296 bytes (4.3 GB, 4.0 GiB) copied, 90 s, 47.7 MB/s
Explanation: This creates a complete bit-for-bit image of the entire disk /dev/sda:
  • if=/dev/sda - Input file (source disk)
  • of=/backup/sda.img - Output file (destination image)
  • bs=4M - Block size of 4 megabytes (faster than default 512 bytes)
  • status=progress - Shows real-time progress (GNU coreutils 8.24+)
This captures everything: partitions, boot sector, filesystem metadata, and all data.
💡 Tip: For faster backups, pipe through compression: dd if=/dev/sda bs=4M | gzip > /backup/sda.img.gz
⚠️ Warning: Ensure the destination has enough space! Use df -h /backup first.

2Restore a Disk from Backup Image

$ sudo dd if=/backup/sda.img of=/dev/sdb bs=4M status=progress
8589934592 bytes (8.6 GB, 8.0 GiB) copied, 180 s, 47.7 MB/s
Explanation: This restores the backup image to a disk. The process:
  • Reads the image file block by block
  • Writes it exactly to the target disk /dev/sdb
  • Recreates partitions, boot records, and all data exactly as it was
Important considerations:
  • Target disk must be at least as large as the source
  • All existing data on target disk will be destroyed
  • Target disk will have identical UUIDs, which may cause conflicts
⚠️ CRITICAL: Reversing if= and of= will destroy your backup! Always verify which device is source and which is destination with lsblk before running.

3Create Bootable USB from ISO Image

$ sudo dd if=ubuntu-24.04-desktop-amd64.iso of=/dev/sdc bs=4M status=progress && sync
3221225472 bytes (3.2 GB, 3.0 GiB) copied, 245 s, 13.1 MB/s
Explanation: This writes an ISO image directly to a USB drive to make it bootable:
  • if=ubuntu-24.04-desktop-amd64.iso - Source ISO file
  • of=/dev/sdc - Target USB device (not a partition like /dev/sdc1)
  • bs=4M - 4MB blocks for faster transfer
  • sync - Forces write buffer to flush to disk
Use lsblk before unplugging to ensure writes are complete.
⚠️ Warning: Use the device name (/dev/sdc), NOT a partition (/dev/sdc1). Verify the correct device with lsblk - writing to the wrong device will destroy that disk!
💡 Tip: After dd completes, run sync and wait for USB activity light to stop before unplugging.

4Wipe a Disk with Zeros

$ sudo dd if=/dev/zero of=/dev/sdb bs=4M status=progress
16106127360 bytes (16 GB, 15 GiB) copied, 335 s, 48.1 MB/s
Explanation: This overwrites every sector of a disk with zeros:
  • if=/dev/zero - Special file that provides an infinite stream of null bytes
  • of=/dev/sdb - Target disk to be wiped
  • Every bit on the disk becomes 0
  • Destroys all partitions, filesystems, and data
This is useful for:
  • Preparing disks for reuse
  • Clearing partition tables
  • Basic data sanitization (single pass)
  • Testing disk write performance
⚠️ Warning: This is NOT secure erasure for sensitive data. Use shred or specialized tools for secure wiping. Single-pass zero-writing can sometimes be recovered with specialized equipment.

5Securely Wipe Disk with Random Data

$ sudo dd if=/dev/urandom of=/dev/sdb bs=4M status=progress
4294967296 bytes (4.3 GB, 4.0 GiB) copied, 890 s, 4.8 MB/s
Explanation: This provides better data destruction by writing random data:
  • if=/dev/urandom - Provides cryptographically secure random data
  • Makes data recovery much more difficult
  • Slower than /dev/zero because random generation takes CPU time
  • Often sufficient for most security requirements
Speed comparison:
  • /dev/zero: ~48 MB/s (disk speed limited)
  • /dev/urandom: ~5 MB/s (CPU limited)
📝 Note: For faster random-like wiping, modern drives support secure erase commands via hdparm or nvme-cli that leverage built-in firmware capabilities.

6Backup Only First Sector (Master Boot Record)

$ sudo dd if=/dev/sda of=mbr-backup.img bs=512 count=1
1+0 records in
1+0 records out
512 bytes copied, 0.00024 s, 2.1 MB/s
Explanation: This backs up only the MBR (Master Boot Record):
  • bs=512 - Block size of 512 bytes (MBR size)
  • count=1 - Copy only 1 block
  • Creates a 512-byte file containing the MBR
The MBR contains:
  • Boot loader code (446 bytes)
  • Partition table (64 bytes for 4 partitions)
  • Boot signature (2 bytes: 0x55AA)
To restore: sudo dd if=mbr-backup.img of=/dev/sda bs=512 count=1
💡 Tip: For GPT disks, backup more: dd if=/dev/sda of=gpt-backup.img bs=512 count=34 (backs up GPT header and partition table).

7Clone Partition to Another Partition

$ sudo dd if=/dev/sda1 of=/dev/sdb1 bs=4M status=progress conv=noerror,sync
10737418240 bytes (11 GB, 10 GiB) copied, 225 s, 47.7 MB/s
Explanation: This clones one partition to another:
  • if=/dev/sda1 - Source partition
  • of=/dev/sdb1 - Destination partition
  • conv=noerror - Continue on read errors
  • conv=sync - Pad failed reads with zeros
The conv=noerror,sync options are crucial for copying potentially failing disks:
  • Without them, dd stops at first read error
  • With them, dd attempts to recover as much data as possible
  • Bad sectors are filled with zeros and marked
⚠️ Warning: Target partition must be equal or larger in size. If larger, the filesystem won't automatically expand - use resize2fs or appropriate tool after cloning.

8Test Disk Write Speed

$ dd if=/dev/zero of=testfile bs=1M count=1024 oflag=direct
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 22.5 s, 47.7 MB/s
Explanation: This benchmarks disk write performance:
  • if=/dev/zero - Fast source of data
  • of=testfile - Creates a 1GB test file
  • bs=1M - 1 megabyte blocks
  • count=1024 - Write 1024 blocks (1GB total)
  • oflag=direct - Bypass cache for accurate results
Without oflag=direct, results may show cache speed, not disk speed.
$ dd if=testfile of=/dev/null bs=1M iflag=direct
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 23.8 s, 45.1 MB/s
For read speed: Reading the test file to /dev/null (discards data) measures read performance.
📝 Note: For more comprehensive disk testing, use fio or hdparm -tT /dev/sda.

9Convert and Copy with Progress Monitoring

$ sudo dd if=/dev/sda of=/dev/sdb bs=64K conv=noerror,sync status=progress
5368709120 bytes (5.4 GB, 5.0 GiB) copied, 112 s, 47.9 MB/s
10737418240 bytes (11 GB, 10 GiB) copied, 224 s, 47.9 MB/s
Explanation: This demonstrates optimal dd usage for disk cloning:
  • bs=64K - Block size optimized for many drives (experiment with 4K, 64K, 1M, 4M)
  • conv=noerror,sync - Handle bad sectors gracefully
  • status=progress - Real-time progress updates
Block size impact on performance:
  • 512 bytes (default): Very slow, many system calls
  • 4K-8K: Good for SSDs (matches page size)
  • 64K-256K: Balanced for most scenarios
  • 1M-4M: Fast for large sequential operations
💡 Tip: On older systems without status=progress, send a USR1 signal to dd to check progress: kill -USR1 $(pgrep ^dd$)

10Create Sparse Files for Testing

$ dd if=/dev/zero of=sparse.img bs=1M seek=1024 count=0
0+0 records in
0+0 records out
0 bytes copied, 0.000123 s, 0.0 kB/s
$ ls -lh sparse.img
-rw-r--r-- 1 user user 1.0G Nov 12 14:23 sparse.img
$ du -h sparse.img
0 sparse.img
Explanation: This creates a sparse file - a file that appears to be 1GB but uses almost no disk space:
  • seek=1024 - Jump forward 1024 blocks (1024 MB)
  • count=0 - Write zero blocks
  • Creates a 1GB "hole" in the file
  • ls -lh shows apparent size (1.0G)
  • du -h shows actual disk usage (0 bytes)
Sparse files are useful for:
  • Virtual machine disk images
  • Database files that will grow over time
  • Testing filesystem handling of large files
  • Saving disk space for mostly-empty files
⚠️ Warning: If you actually write data to a sparse file, it will consume real disk space. If the disk is full, writes will fail even though the file seemed to have space!

📚 Common DD Options

Option Description Example
if=FILE Input file or device if=/dev/sda
of=FILE Output file or device of=/backup/disk.img
bs=SIZE Block size (bytes, K, M, G) bs=4M
count=N Copy only N blocks count=100
skip=N Skip N blocks at input start skip=10
seek=N Skip N blocks at output start seek=20
conv=noerror Continue on read errors conv=noerror,sync
conv=sync Pad blocks with zeros conv=sync
status=progress Show transfer progress status=progress
iflag=direct Use direct I/O for input iflag=direct
oflag=direct Use direct I/O for output oflag=direct

💽 Special Files Used with DD

Special File Description Common Use
/dev/zero Infinite stream of null bytes (0x00) Wiping disks, testing write speed
/dev/urandom Random data from kernel RNG Secure wiping, testing
/dev/random Blocking random data (higher quality) Cryptographic operations
/dev/null Discards all data written to it Testing read speed, suppressing output
/dev/sdX Entire disk device Cloning whole disks
/dev/sdX1 Individual partition Cloning partitions

🔧 Common Use Cases

Full Disk Backup with Compression:
$ sudo dd if=/dev/sda bs=4M status=progress | gzip -c > /backup/sda.img.gz
Creates compressed backup image. Restore with: gunzip -c /backup/sda.img.gz | sudo dd of=/dev/sda bs=4M status=progress
Network Disk Clone:
Receiver: $ nc -l 9000 | sudo dd of=/dev/sdb bs=4M status=progress
Sender: $ sudo dd if=/dev/sda bs=4M status=progress | nc targethost 9000
Clones disk over network using netcat.
Rescue Failing Disk:
$ sudo dd if=/dev/sda of=/backup/sda.img bs=4K conv=noerror,sync status=progress
Use smaller block size (4K) and error handling for failing drives. For better recovery, use ddrescue instead.
⚠️ CRITICAL SAFETY REMINDERS:
  • ALWAYS verify device names with lsblk or fdisk -l before running dd
  • NEVER confuse if= and of= - if= is source (input), of= is destination (output)
  • Unmount filesystems before cloning with umount /dev/sdX1
  • Use whole device names for full disk ops (/dev/sdc), not partitions (/dev/sdc1)
  • Double-check partition vs device - mixing them up causes data loss
  • There is NO undo - dd begins overwriting immediately
  • Test with small files first when learning dd commands
  • Consider using safer alternatives like rsync, clonezilla, or partclone when possible