[GLLUG] imaging further with dd?

STeve Andre' andres at msu.edu
Wed Nov 8 15:11:29 EST 2006


I don't think your different hard drives are that different.  dd is
dumb, a virtue in this case, by simply scooping up data sector
by sector.  When you lay that data down with another dd, a 
disk with different disk geometry is going to give you a problem.
dd is fine for cloning identical disks, but I stopped using it when
I made a copy from a disk to a bigger disk and had a mess
resulting from that.  It may be the case that modern disks are
close enough that this will always work, though.

What could be faster than dd?  Reading and writing a raw disk
like  dd if=/dev/wd0c of=/dev/wd1c bs=64k   is pretty simple
and tests the limits of the throughput of the disks and controllers.
Is there really something faster than that, or does the Helix tool
remember to use a larger buffer?

--STeve Andre'
On Wednesday 08 November 2006 14:53, Lachniet, Mark wrote:
> I've done a lot of dd copies for forensic analysis and so on and have never
> had a problem booting a copy, even on radically different hard drives (as
> long as they are both IDE, for example, you should be fine).  From my
> personal experience, as long as the target drive is big enough you'll be
> fine.
>
> BTW, there is a better bit-level copy program on the Helix boot CD - faster
> and better than dd
>
> Mark Lachniet
> Technical Director, Security Group
> Analysts International
> (517) 336-1004 (voice)
> (517) 336-1160 (fax)
> mailto: mlachniet at analysts.com
>
>
>
>
> From: Charles Ulrich
> Sent: Wed 11/8/2006 12:45 PM
> To: Benjamin Cathey
> Cc: linux-user at egr.msu.edu
> Subject: Re: [GLLUG] imaging further with dd?
>
> Benjamin Cathey wrote:
> > Okay - here is what I am trying
> >
> > Booting both machines with a LiveCD (Insert Security.)  Then on the
> > receiving machine:
> >
> > netcat -l -p 9000 | dd of=/dev/hda
> >
> > On the source machine:
> >
> > dd if=/dev/hda | netcat 192.168.0.173 9000
>
> Just remember that dd does a bit-for-bit copy and that if the two drives
> aren't the same exact model number, the results may not be what you expect.
> If they are different, you may get better mileage out of rsync or some
> other file-based backup utility.


More information about the linux-user mailing list