dd

dd is a common Unix program whose primary purpose is the low-level copying and conversion of files. Some have suggested that it stands for Copy and Convert, but since "cc" was already in use as the code for the C Compiler, "dd" was used instead; in any case, DD is a shorthand for "data definition" in IBM JCL (to which the command's syntax bears a strong resemblance) and the name and syntax of the command is generally presumed to be a bit of gallows humor.

dd has a different set of command line options than the ordinary cp command (which copies files in their entirety) that allow copying a fixed number of bytes or blocks, performing on-the-fly byte order conversions, as well as more esoteric EBCDIC to ASCII conversions. Nowadays dd is mostly used to copy regions of raw device files, e.g. backing up the boot sector of a hard disk, or to read fixed amounts of data from special files like /dev/zero or /dev/random. Because dd can copy entire partitions or disks (this is more due to Unix providing access to these devices than the functionality of dd per se), it is used in computer forensics when the contents of a partition need to be preserved in a byte-exact copy. Using cp would not be enough, since data from deleted files that may still be present on a disk are not visible through the file system interface. It is jokingly said to stand for "destroy disk" or "delete data", since, being used for low-level operations on hard disks, a small mistake, such as reversing the if and of parameters, may accidentally render the entire disk unusable.[1]

The command line syntax of dd is unlike that of any other Unix program; a violation of the Unix philosophy of using a common syntax for all command line tools. Generally, dd uses an option=value format, whereas most Unix programs use a -option value format. Also, dd's input is specified using the "if" (input file) option, while most programs simply take the name by itself. It is rumored to have been based on IBM's JCL, and though the syntax may have been a joke, there seems never to have been any effort to write a more Unix-like replacement.

Usage

dd [options]

operands

if=file 

Input File: Read from file instead from standard input.

of=file 

Output File: Write to file instead to standard output. See also the keyword notrunc.

ibs=bytes 

Input Block Size: Read bytes bytes at once.

obs=bytes 

Output Block Size: Write bytes bytes at once.

bs=bytes 

Block Size: A shortcut for ibs=bytes obs=bytes. If the user does not provide a block size, 512 bytes is used[2].

count=blocks 

Count: copy only this many blocks from the input to the output, then stop.

skip=blocks 

When starting to read from input, skip blocks number of blocks of size ibs.

seek=blocks 

When starting to write to output, skip blocks number of blocks of size obs.

conv=keywords 

Convert the file according to a comma-separated list of keywords.

cbs=bytes 

Convert Block Size: Convert bytes bytes at once.

conv

When specifying conv as parameter the following keywords may be used:

ascii 

Convert from EBCDIC to ASCII.

ebcdic 

Convert from ASCII to EBCDIC.

ibm 

Convert from ASCII to an alternative EBCDIC.

block 

Fill datasets which are terminated by a newline-character with space-characters to fit size of cbs.

unblock 

Replace trailing space-characters in datasets of size cbs with newline-characters.

lcase 

Change uppercase characters to lowercase.

ucase 

Change lowercase characters to uppercase.

notrunc 

Do not truncate output file to zero bytes before writing to it. If the existing output file is shorter than the amount of data to be written to it, this will cause the written data to overwrite the initial portion, leaving the remainder intact.

swab 

Swap every pair of input bytes.

noerror 

Ignore reading errors and continue.

sync 

Pad every input block with null bytes if it is shorter than the size specified. If used with block or unblock, pad with space characters instead.

Notes and units

On various systems the option --version is supported. dd will then output its version number and quit.

file may be any real file or any block-device file.

On certain systems bytes may be specified with multiplicative units. This units may then be[3]:

c 

Character: 1

w 

Word: 2

b 

Block: 512

kB 

Decimal kilobytes: 1,000 bytes

k 

Binary kilobytes (kibibytes): 1,024 bytes

MB 

Decimal megabytes: 1,000,000 bytes

M 

Binary megabytes (mebibytes): 1,048,576 bytes (1,024×1,024)

This may be carried on similarly with G, T, P, E, Z, Y. The standard "IEEE Std 1003.1" only requires that the 'b' and 'k' multipliers be supported, and does not specify the meaning of any other multipliers. Also, multiple numbers may be provided separated by 'x'. These numbers are multiplied together.

Examples

To create an image file named floppy.img of a floppy disk in the drive whose block-device name is /dev/fd0 (as the first floppy device is on Linux), one may invoke dd in the following way:

dd if=/dev/fd0 of=floppy.img

Note: To copy a floppy image to a disk (erasing any existing data on the disk), simply reverse of and if of the previous example.

To create a file with name reallylargefile with the size of 1 GB, filled with random data, do this (1G = 1073741824, 1073741824 / 512 = 2097152 (the default block size is 512)):

dd if=/dev/random of=reallylargefile count=2097152

To fill the file with NULL characters, use /dev/zero instead of /dev/random. This can be used to mount a filesystem if you have a FAT32 device, but need the flexibility of EXT2 - as follows:

dd if=/dev/zero of=my.new.virtual.harddisk count=10G

mke2fs my.new.virtual.harddisk (reply yes when it says it's not a block device)

mkdir /mnt/virtual

mount -o loop my.new.virtual.harddisk /mnt/virtual/

To increase writing performance obs can be increased:

dd if=/dev/random of=reallylargefile obs=4096

This will write the first partition of the first harddisk to the file mywindowspartition.image.

dd if=/dev/hda1 of=mywindowspartition.image

These examples are Linux-centric: on other platforms the device names may be different.

For many more examples of the Linux dd command, which is the same as the UNIX version, go here: http://www.linuxquestions.org/questions/showthread.php?t=362506

Anti-examples

WARNING: Do NOT try these examples; they will destroy data!

The following examples are provided to warn about the dangers of dd, if used incorrectly. Trying any of these commands with the proper privileges will almost certainly result in major data loss, and may make the system unusable.

This overwrites the complete first hard disk with null bytes, erasing it (do that if you want to sell a hd, that contained company secrets, though this is not really secure):

dd if=/dev/zero of=/dev/hda

This overwrites the first few blocks of the first hard disk with the file, resulting in a loss of the partition table:

dd if=funnysong.mp3 of=/dev/hda

This will completely corrupt an entire hard disk (/dev/dsp is the sound player/recorder):

dd if=/dev/dsp of=/dev/hda

This will overwrite an entire disk with pseudorandom data, making its initial contents irrecoverable

dd if=/dev/urandom of=/dev/hda

These examples are Linux-centric. On other platforms the device names may be different.

See also

• List of Unix programs

External links

• The Open Group Base Specifications Issue 6 of the dd utility
• dd for Windows
• User group post on using DD
• Wonders of 'dd' and 'netcat' :: Cloning Operating Systems - Several examples of use
• Cloning Hard Drives with GNU/Linux