Archive and Clone Filesystems with dd in Linux

Learn how to create, restore, verify, split, and safely clone raw Linux filesystem and partition images with dd.

What dd Does

dd is a Unix/Linux utility that copies data at the byte or block level. Unlike a file backup program, it does not normally interpret directories, permissions, or filesystem structures. It reads a sequence of blocks from an input and writes those blocks to an output.

A raw image is a byte-for-byte file representation of a storage device, partition, or medium. The image can include filesystem metadata, allocated blocks, unused space, boot information, and other data present in the source range.

This makes dd useful for low-level imaging, but also makes it dangerous: writing to the wrong destination can overwrite data immediately.

Raw Imaging Compared with File-Level Backup

Tools such as tar and filesystem-aware backup programs work with files and directories. They can usually omit unused blocks and may provide more flexibility when restoring individual files. A raw image instead preserves the storage layout of the copied range.

Copy granularity: dd copies blocks; a file-level backup copies files and directory metadata.

Unused-space handling: A raw image copies unused blocks; a file-level backup normally skips them.

Image size: A raw image is approximately the size of the copied partition or device, while a file-level backup is closer to the amount of selected data, often after compression.

Filesystem support: dd can copy a filesystem format it does not understand. File-level tools generally need to read the filesystem through the operating system.

Restore flexibility: A raw image restores the copied range as a whole. File-level backups are usually better for restoring selected files.

Typical use cases: Raw images suit optical media, complete partitions, unknown filesystems, removable media, and exact cloning. File-level backups suit routine document and system-file backups.

When a dd Image Is Appropriate

Create an image of optical media such as a CD-ROM or another removable medium.
Back up a filesystem whose format Linux cannot mount or does not understand.
Create an exact backup of a complete partition.
Clone a known-good Linux installation to compatible hardware with a destination that is large enough.

For regular backups of changing files, a filesystem-aware tool may be more efficient. For snapshots of a live filesystem, use an appropriate snapshot mechanism when available. Reading a filesystem while it changes can produce an inconsistent image.

Understanding dd Operands

The basic form is:

dd if=SOURCE of=DESTINATION

if= means input file, and identifies the source. of= means output file, and identifies the destination. Despite their names, either operand can refer to an ordinary file, a partition, a whole disk, optical media, or a standard stream.

sudo dd if=/dev/sdc1 of=/path/to/backup/sdc1_content.img status=progress

In this example, /dev/sdc1 is a partition represented by a block device, and the destination is an ordinary image file on another filesystem. Always verify both paths independently before pressing Enter. A reversed if= and of= can turn a backup operation into a destructive overwrite.

if=: Specifies the input source. Example: if=/dev/sdc1. Confirm that it is the intended source.

of=: Specifies the output destination. Example: of=/path/to/backup/sdc1_content.img. Writing to a device overwrites its contents.

bs=: Sets the block size used for reads and writes. A moderate value can affect performance, but it does not change what is copied. Choose deliberately and test in your environment.

status=progress: Displays ongoing transfer progress during a long copy.

conv=fsync: Requests that dd flush output data before it exits, helping ensure that written data reaches the destination.

sync: Can be used as a separate command, sync, to request that pending filesystem writes be flushed. It is not the same as the conv=fsync conversion option.

Identify Disks and Partitions First

Linux exposes storage devices through the /dev namespace. A whole disk might appear as /dev/sdc, while its first partition might appear as /dev/sdc1. The distinction matters: copying a whole disk includes its partition table and all partitions, while copying /dev/sdc1 copies only that partition's contents.

lsblk -f
findmnt

Use lsblk -f to inspect device names, sizes, filesystem types, labels, and mount points. Use findmnt to see which filesystems are mounted and where. Device names can change when drives are added or removed, so do not rely only on a remembered name.

Create a Partition Image

Suppose the source partition is /dev/sdc1 and the image will be stored on a different, mounted filesystem:

sudo dd if=/dev/sdc1 of=/path/to/backup/sdc1_content.img status=progress

The image contains the raw contents of the partition, including filesystem metadata, allocated blocks, and unused space. It is therefore approximately as large as the entire source partition, not merely the data currently visible in its directories.

For a consistent offline image, stop applications that write to the source and unmount the source filesystem before reading it. Do not unmount a partition that is required by the running system without understanding the consequences; use a rescue environment or a suitable snapshot when necessary.

Create an Optical or Removable-Media Image

An optical drive commonly appears as /dev/sr0. A raw capture can be created with:

dd if=/dev/sr0 of=disc-image.iso status=progress

The same pattern applies to other removable media. Check the device identity first, and ensure that the output file is stored somewhere with enough free space.

Restore a Partition Image

Restoration reverses the input and output roles:

sudo dd if=/path/to/backup/sdc1_content.img of=/dev/sdc1 status=progress

Destructive operation: The target specified by of= is overwritten. Confirm the target device, partition, size, and mount status immediately before running the command.

Unmount the destination partition before restoring. The destination must be at least as large as the source range represented by the image. If it is smaller, the restore can fail or produce an incomplete result. After restoration, allow pending writes to finish:

sync

Storage Requirements and Unused Space

dd copies every block in the selected range. If a 20 GB partition contains only 2 GB of files, a raw image can still require about 20 GB because the remaining blocks are unused space that the partition owns.

This is less space-efficient than a file-level backup unless compression or sparse-file techniques are deliberately used. A sparse file represents long zero-filled regions without necessarily allocating equivalent physical disk space, but sparse handling must be planned and preserved throughout copying and storage. Do not assume that unused blocks are all zeroes or that every destination filesystem supports sparse files as expected.

Before imaging, verify that the filesystem holding the image has sufficient free space. Also account for other copies, checksums, split pieces, and temporary reassembled files.

Cloning Disks and Partitions

Cloning means duplicating a disk or partition to another storage location or machine. Direct cloning is simplest when the source and destination have the same size and compatible layouts. A destination must not be smaller than the copied source content, even if the source currently contains little user data.

A whole-disk clone copies more than a filesystem: it can include the partition table, boot sectors, and every partition in the selected disk range. A partition image copies only the selected partition, so the destination layout must already provide a suitable partition.

When cloned machines operate simultaneously, they may initially share identity data. Change host-specific settings such as hostnames, network identities, and filesystem identifiers as appropriate for the operating system and deployment method. Otherwise, machines can conflict on a network or appear indistinguishable to management systems.

Pre-Flight Safety Checklist

Correct source device: Prevents imaging the wrong disk. Confirm with lsblk -f, size, label, and mount point.

Correct destination device: Prevents destructive overwrites. Trace the destination path and confirm whether it is a file, partition, or whole disk.

Unmount status: Helps create a consistent source image and prevents mounted data from being overwritten during restore. Check with findmnt.

Available image storage: Prevents an interrupted image because the destination filesystem ran out of space. Check free capacity before starting.

Destination size: Ensures the target can contain the source image. Compare device or partition sizes with lsblk.

Backup and verification plan: Limits the impact of operator error or media failure. Keep an independent backup and test a restore.

Elevated privileges are commonly required for block-device access. Use sudo only after validating every device path; elevated access does not make an incorrect path safe.

Progress, Performance, and Durability

Long copies can appear idle without progress reporting. Add status=progress to display bytes transferred and current throughput.

The bs= operand controls the size of each read and write operation. Larger blocks can reduce overhead for some devices, while device characteristics, storage drivers, and workload affect the result. Block size is primarily a performance choice; it does not make a raw image file-level-aware.

When output durability matters, use conv=fsync in the dd command or run sync after the operation. These actions help flush buffered writes, but they do not protect against a failing device or an interrupted power supply.

Verify an Image or Copy

A checksum is a calculated digest used to detect changed or incorrectly transferred data. Record a checksum after creating an image:

sha256sum /path/to/backup/sdc1_content.img > /path/to/backup/sdc1_content.img.sha256

Later, calculate the checksum again and compare it with the recorded value:

sha256sum /path/to/backup/sdc1_content.img

For a byte-level comparison, compare an image with an unmounted target of the same represented range:

cmp /path/to/backup/sdc1_content.img /dev/sdc1

Verification does not replace a restore test. Periodically restore to suitable test media or a test machine, confirm that the result boots or mounts as expected, and retain an independent backup.

Split a Large Image

Splitting is separate from image creation. It divides an already-created image file into multiple pieces for storage or transfer limits.

split -b 4G /path/to/backup/sdc1_content.img sdc1_content.img.part-

The pieces must be recombined in their original order before verification or restoration:

cat sdc1_content.img.part-* > sdc1_content.img

Use a naming scheme that preserves lexical order, keep every piece, and verify the reassembled image's checksum before writing it to a device.

Troubleshooting

The Image Is Nearly as Large as the Partition

This is expected for raw imaging because dd copied unused blocks as well as active data. Provide storage for the complete partition or choose a file-level backup when preserving only active files is more appropriate.

The Wrong Disk or Partition Was Selected

Stop before writing if there is any uncertainty. Re-run lsblk -f, confirm sizes and mount points, and identify source and destination using more than a device name alone. If a destructive write has already begun, stop it promptly, but understand that some data may already be lost.

The Restore Is Incomplete

A target smaller than the source image or an interrupted copy can cause failure or an incomplete target. Use an equal or larger destination, ensure adequate power and storage, and verify the image before restoring.

The Image Is Not Consistent

If the source changed while it was being read, the image may capture data from different filesystem states. Create an offline image from an unmounted filesystem or use an appropriate snapshot mechanism.

Permission Is Denied

Raw block-device access generally requires elevated privileges. Use sudo after independently checking the source and destination paths.

Cloned Machines Conflict

A raw clone duplicates system identity data. Before connecting clones to the same network, change host-specific settings and regenerate identifiers as appropriate for the operating system.

Exam-Relevant Notes

if= is the input source; of= is the output destination.
Reversing the operands restores an image but overwrites the specified target.
Raw imaging copies unused space, so image size follows the copied partition or device range.
Unmounting supports filesystem consistency during imaging and prevents mounted targets from being overwritten during restoration.
The destination must not be smaller than the source content being copied.
status=progress reports progress; bs= affects transfer block size; conv=fsync requests output flushing.
A checksum checks image integrity, while a restore test checks whether the backup is operational.

Summary

dd creates exact low-level images by copying blocks from if= to of=. It is useful for complete partitions, optical media, removable media, unknown filesystems, and compatible system clones. Its strengths come with costs: it copies unused space, requires careful device identification, and can destroy data when the destination is wrong. Plan storage, unmount where appropriate, monitor progress, verify checksums, and test restoration before relying on an image.

For related Linux command-line concepts, see Show the Full Path Of Shell Commands and the Linux topic index.