This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| dd | |
|---|---|
| Name | dd |
| Developer | Bell Labs / AT&T Corporation |
| Released | 1970s |
| Operating system | Unix and Unix-like systems, GNU/Linux, FreeBSD, OpenBSD, NetBSD, macOS |
| Platform | x86, x86-64, ARM, PowerPC, SPARC |
dd dd is a Unix utility for copying and converting raw data between files, devices, and streams. Originally developed in the 1970s at Bell Labs as part of the Version 7 Unix toolset, dd is widely used on GNU/Linux, FreeBSD, OpenBSD, NetBSD, and macOS for low-level tasks such as disk imaging, device wiping, and bootloader installation. Its terse syntax and byte-oriented operation make it a versatile but potentially dangerous tool when misused.
dd operates at the block level, reading input from a source and writing output to a destination with optional conversion and block-size control. The utility interacts directly with device special files such as raw block devices on Linux kernel-based systems or character devices on BSD derivatives. dd is often invoked from a privileged shell such as those run by root or users with sudo privileges to access device nodes like /dev/sda or /dev/rdisk0. Historically, dd's terse and positional argument style traces to early Unix design philosophies exemplified by tools developed at Bell Labs.
The typical dd invocation uses operand-style parameters rather than mnemonic long options. Common parameters include: - if=FILE and of=FILE to specify input and output files, respectively, often mapped to device nodes such as /dev/sdb on Linux or /dev/rdisk2 on macOS. - bs=BYTES, ibs=BYTES, obs=BYTES for block sizes; count=NUMBER to limit blocks copied; skip=NUMBER and seek=NUMBER to offset input/output positions. - conv=CONVS to request conversions such as noerror, sync, notrunc, and fdatasync.
Different implementations (e.g., the GNU coreutils dd versus the version in FreeBSD or OpenBSD) may support additional flags such as status=LEVEL for progress reporting or oflag=FLAGS and iflag=FLAGS for low-level I/O semantics like direct, dsync, or nonblock. dd can be combined with utilities like pv (software) for progress display, or used in pipelines with gzip, xz (file compressor), openssl, and nc (netcat) for compression, encryption, and network transfer.
- Disk imaging and cloning between block devices or files, often used in conjunction with clonezilla-style workflows or bespoke scripts for deploying Debian (operating system), Ubuntu (operating system), CentOS, or Fedora (operating system) systems. - Creating bootable media by writing ISO images for distributions such as Arch Linux, Gentoo Linux, Kali Linux, or Windows ISOs to USB devices. - Secure wiping and sanitization of storage by overwriting with patterns or pseudorandom data sourced from /dev/urandom or /dev/random, sometimes used alongside standards like those from the National Institute of Standards and Technology. - Backup and recovery tasks including copying partition images for GRUB bootloader recovery or extracting MBR and GPT headers for emergency repair with tools such as testdisk and photorec. - Repair and forensic acquisition via read-only access of physical devices when used with flags that minimize caching and avoid altering timestamps, often coordinated with evidence-handling procedures from organizations like International Organization on Computer Evidence.
- Create an image of a device: dd if=/dev/sdb of=backup.img bs=4M status=progress (Typical on GNU/Linux systems for backing up USB drives and SD cards.) - Write an ISO to USB: dd if=debian.iso of=/dev/sdc bs=1M conv=fsync (Common for installing Debian (operating system) or booting live environments.) - Wipe a disk with zeros: dd if=/dev/zero of=/dev/sda bs=1M status=progress (Used prior to repartitioning or before secure disposal; see NIST guidance.) - Copy only the first 512 bytes (MBR): dd if=/dev/sda of=mbr.bin bs=512 count=1 (Useful when extracting GRUB metadata or MBR boot code for diagnostics.) - Stream an image over SSH: dd if=/dev/sda bs=1M | ssh user@host "dd of=/tmp/disk.img bs=1M" (Used in remote imaging workflows involving OpenSSH and remote hosts.)
Performance depends on block size, I/O scheduler in the Linux kernel, device characteristics of SSDs or HDDs from manufacturers like Seagate or Western Digital, and filesystem caching behavior. Larger bs values (e.g., 4M or 8M) often yield higher throughput for sequential transfers, while smaller blocks may be useful for fine-grained control. Using oflag=direct or iflag=direct can bypass page cache to reduce double-buffering overhead, but may interact with device alignment and wear characteristics on NAND flash devices.
Safety considerations are paramount: dd can irreversibly overwrite partitions and device metadata, potentially corrupting partition tables used by GUID Partition Table or MBR (master boot record). Always verify target device identifiers using tools such as lsblk, fdisk, parted, or diskutil (macOS) before writing. Prefer read-only imaging when performing forensic acquisition, and consider write-blocking hardware from vendors like WiebeTech or CRU for evidence preservation. Use status=progress or monitoring tools like iotop to observe I/O, and ensure appropriate backups exist before destructive operations.
Several utilities provide higher-level features or safer interfaces: - cp and cat for simple file copies (when not operating on raw devices). - pv (software) for progress indication in pipelines. - ddrescue and dd_rescue for robust recovery from damaged media. - partclone and ntfsclone for filesystem-aware cloning of NTFS or other filesystems. - Clonezilla for image-based mass-deployment and partition-level operations. - gnome-disks and KDE Partition Manager for graphical disk imaging on GNOME or KDE desktops. - rsync and borgbackup for incremental and deduplicated backups.