Dd (Unix)

dd is a common UNIX program whose primary purpose is the low-level copying and conversion of raw data. dd is an abbreviation for "data definition" in IBM JCL, and the command's syntax is meant to be reminiscent of this. cite web | url=http://www.catb.org/jargon/html/D/dd.html | title=dd | author=Eric S. Raymond | accessdate=2008-02-19 ]

dd is used to copy a specified number of bytes or blocks, performing on-the-fly byte order conversions, as well as more esoteric EBCDIC to ASCII conversions. cite web | url=http://www.codecoffee.com/tipsforlinux/articles/036.html | title=How and when to use the dd command? | author=Sam Chessman | publisher=CodeCoffee | accessdate=2008-02-19 ] dd can also be used to copy regions of raw device files, e.g. backing up the boot sector of a hard disk, or to read fixed amounts of data from special files like /dev/zero or /dev/random. [ cite web | url=http://wiki.linuxquestions.org/wiki/Dd | title=Dd - LQWiki | publisher=LinuxQuestions.org | accessdate=2008-02-19 ]

It can also be used in computer forensics when the contents of a disk need to be preserved as a byte-exact copy. Using cp would not be sufficient because data from deleted files still physically present on a disk are not visible through the file system interface.

It is jokingly said to stand for "destroy disk" or "delete data", since, being used for low-level operations on hard disks, a small mistake, such as reversing the if and of parameters, may accidentally render the entire disk unusable.

Disks over 137GB

Seagate documentation warns, "Certain disc utilities, such as DD, which depend on low-level disc access may not support 48-bitLBAs until they are updated." [ [http://www.seagate.com/support/kb/disc/tp/137gb.pdf Windows 137GB Capacity Barrier - Seagate Technology] ] 48-bit LBA is required for harddrives over 137GBs in size.

Usage

The command line syntax of dd is significantly different from most other UNIX programs, and because of its ubiquity it is resistant to recent attempts to enforce a common syntax for all command line tools. Generally, dd uses an option=value format, whereas most Unix programs use a -option value format. Also, dd's input is specified using the "if" (input file) option, while most programs simply take the name by itself. It is rumored to have been based on IBM's JCL, and though the syntax may have been a joke, there seems never to have been any effort to write a more Unix-like replacement.

Example use of dd command to create a disk image from a CD-ROM: dd if="/dev/cdrom" of="image.iso" bs="2k"

Note that an attempt to copy the entire disk image using cp may omit the final block if it is an unexpected length; dd will always complete the copy if possible.

Using dd to wipe an entire disk with random data: dd if="/dev/urandom" of="/dev/hda"

Create a 1GB file containing only zeros (bs=blocksize, count=number of blocks): dd if=/dev/zero of=mytestfile.out bs=1000 count=1000000

Create a 1GB sparse file or resize an existing file to 1GB without overwriting: dd if=/dev/zero of=mytestfile.out bs=1 count=0 seek=1G

Some implementations understand x as a multiplication operator in the block size and count parameters: dd bs=2x80x18b if=/dev/fd0 of=/tmp/floppy.image

where the "b" suffix indicates that the units are 512-byte blocks. Unix block devices use this as their allocation unit by default.

For the value of bs field, following decimal number can be suffixed: w means 2 b means 512 k means 1024

Hence bs=2*80*18b means, 2*80*18*512=1474560 which is the exact size of 1.44 MB Floppy

Output messages

The GNU variant of dd as supplied with Linux does not describe the format of the messages displayed on stdout on completion, however these are described by other implementations e.g. that with BSD.

Each of the "Records in" and "Records out" lines shows the number of complete blocks transferred + the number of partial blocks, e.g. because the physical medium ended before a complete block was read.

Recovery-oriented variants of dd

Open Source unix-based programs for rescue include [http://www.garloff.de/kurt/linux/ddrescue/ dd_rescue] and [http://www.kalysto.org/utilities/dd_rhelp/index.en.html dd_rhelp] , which work together, or [http://www.gnu.org/software/ddrescue/ddrescue.html GNU ddrescue] .

*dd_rhelp first extracts all the readable data, and saves it to a file, inserting zeros where bytes cannot be read. Then it tries to re-read the invalid data and update this file.
*GNU ddrescue can be used to copy data directly to a new disk if needed, just like Linux dd.

dd_rhelp or GNU ddrescue will yield a complete disk image, faster but possibly with some errors. GNU ddrescue is generally much faster, as it is written entirely in C++, whereas dd_rhelp is a shell script wrapper around dd_rescue. Both dd_rhelp and GNU ddrescue aim to copy data fast where there are no errors, then copy in smaller blocks and with retries where there are errors. GNU ddrescue is easy to use with default options, and can easily be downloaded and compiled on Linux-based Live CDs such as Knoppix, and can be used with SystemRescueCD.

GNU ddrescue example [ cite web | url=http://www.cgsecurity.org/wiki/Damaged_Hard_Disk | title=Damaged Hard Disk | publisher=www.cgsecurity.org | accessdate=2008-05-20 ]
# first, grab most of the error-free areas in a hurry:ddrescue -n /dev/old_disk /dev/new_disk rescued.log
# then try to recover as much of the dicey areas as possible:ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log

See also

*List of Unix programs
*Backup
*Disk cloning
*Disk image
*Loopback
*SpinRite (includes coverage of recovery-oriented variants of dd)

References

External links

* [http://www.gnu.org/software/coreutils/manual/html_node/dd-invocation.html dd] : manual page from GNU coreutils.
* [http://www.chrysocome.net/dd dd for Windows] .
* [http://www.opengroup.org/onlinepubs/009695399/utilities/dd.html The Open Group Base Specifications Issue 6 of the dd utility]
* [http://www.gnu.org/software/ddrescue/ddrescue.html ddrescue] .
* [http://www.softpanorama.org/Tools/dd.shtml Softpanorama dd page] .