dd

Updated

September 4, 2026

Overview

dd copies and converts data at the block level. Operators use it to image disks/USBs, write ISO files to removable media, create sparse files, and dump raw device ranges. It is powerful and easy to destroy the wrong disk — always verify source and destination with lsblk first. For day-to-day file copies prefer cp or rsync; for cloning partitions with progress, many prefer pv + dd or dedicated tools (Clonezilla, partclone).

Syntax

dd if=INPUT of=OUTPUT [bs=BYTES] [count=N] [status=progress] [conv=OPTS] [oflag=OPTS] ...

Operands are key=value (GNU style). Order of operands generally does not matter.

Common Options

Option Description
if=FILE Input file/device (default: stdin)
of=FILE Output file/device (default: stdout)
bs=BYTES Read and write BYTES at a time (e.g. 4M)
ibs= / obs= Separate input/output block sizes
count=N Copy only N input blocks
skip=N Skip N input blocks
seek=N Skip N output blocks
status=progress Periodic transfer stats (GNU)
conv=fsync fsync output file before finish
conv=noerror,sync Continue on read errors; pad bad blocks (imaging damaged media)
conv=sparse Try to seek over zero blocks on output
iflag=fullblock Accumulate full input blocks (safer pipes)
oflag=direct Attempt O_DIRECT writes (device-dependent)
oflag=sync Synchronous writes each block (slow, durable)

Size suffixes (GNU): K, M, G (1024-based); KB, MB, GB (1000-based). Check man dd for your coreutils version.

Safety

dd will overwrite the destination without asking. Wrong of= is a classic way to wipe a system disk.

  1. Identify devices first — never guess /dev/sdX vs /dev/nvme…:

    lsblk -o NAME,SIZE,TYPE,TRAN,MODEL,MOUNTPOINTS,SERIAL
# unplug/replug USB and re-run to see which node appears

  2. Confirm the USB/target is unmounted before writing a whole disk image.

  3. Prefer status=progress so a hung or wrong device is obvious sooner.

  4. After writing boot media, run sync (or conv=fsync) before unplugging.

  5. Prefer read-only checks (if= only, or write to a file first) when learning.

  6. On multi-disk hosts, label targets and double-check SERIAL/MODEL.

  7. Do not copy from/to a mounted filesystem’s block device for “live backup” unless you know the consistency implications.

If unsure of the device node: stop. Physical write-protect switches and working on a spare machine reduce risk.

Examples with Explanations

List devices before any write

lsblk -o NAME,SIZE,TYPE,TRAN,MODEL,MOUNTPOINTS
# Example: USB stick shows as sdb, not sda (system disk)

Always map physical media → /dev/... before setting of=.

Write an ISO to a USB stick (destructive to the stick)

# 1) Identify stick — here assumed /dev/sdX (REPLACE X)
lsblk -o NAME,SIZE,TRAN,MODEL,MOUNTPOINTS

# 2) Unmount any auto-mounted partitions
sudo umount /dev/sdX* 2>/dev/null || true

# 3) Write whole-disk image
sudo dd if=ubuntu-24.04-desktop-amd64.iso of=/dev/sdX bs=4M status=progress conv=fsync oflag=direct

# 4) Ensure buffers flushed before yank
sync

of= is the whole disk (/dev/sdX / /dev/nvme1n1), not a partition, for hybrid ISOs. bs=4M is a practical throughput compromise; conv=fsync flushes on completion.

Create a raw disk image (backup a USB)

sudo umount /dev/sdX* 2>/dev/null || true
sudo dd if=/dev/sdX of=usb-backup-$(date +%F).img bs=4M status=progress conv=fsync
ls -lh usb-backup-*.img

Stores every byte of the device (including free space). Compress afterward if needed: gzip -1 usb-backup.img.

Restore an image to a USB

sudo umount /dev/sdX* 2>/dev/null || true
sudo dd if=usb-backup.img of=/dev/sdX bs=4M status=progress conv=fsync
sync

Destination size must be ≥ image size. Again: verify of= with lsblk.

Sparse empty file (test disk image)

dd if=/dev/zero of=disk.img bs=1M count=0 seek=1024
# or: truncate -s 1G disk.img
ls -lh disk.img
du -h disk.img          # sparse: little real space used

Useful for loop devices (losetup) and VM-style experiments without writing 1 GiB of zeros immediately.

Sample first megabyte (forensics / header peek)

sudo dd if=/dev/sdX bs=1M count=1 status=none | xxd | head
sudo dd if=/dev/sdX bs=512 count=1 of=mbr.bin

Read-only sampling of boot sectors or magic headers without imaging the whole device.

Damaged media (best-effort copy)

sudo dd if=/dev/sdX of=recovered.img bs=4M conv=noerror,sync status=progress

Continues past read errors and pads failed blocks. For serious recovery prefer ddrescue (gddrescue package) — better logging and retry logic.

Progress with pv (when installed)

sudo apt install pv    # if needed
sudo pv -tpreb ubuntu.iso | sudo dd of=/dev/sdX bs=4M conv=fsync

pv gives a clearer progress bar; still requires correct of=.

Wipe a USB free-space / reuse (destructive)

# Optional: overwrite with zeros (slow) or random
sudo dd if=/dev/zero of=/dev/sdX bs=4M status=progress conv=fsync
# Then re-partition / mkfs as needed

This destroys all partitions and data on the device. For secure erase of SSDs prefer vendor tools / blkdiscard where appropriate — sequential dd is not always the right model for flash.

Notes

  • GNU dd on Ubuntu supports status=progress; some embedded dd builds do not.
  • Block size affects speed more than correctness for full copies; very small bs is slow, huge bs can increase memory pressure.
  • Writing an ISO with cp/cat to the device node also works on Linux; dd remains common in docs and scripts.
  • USB path stability: prefer /dev/disk/by-id/... when scripting if nodes reorder across boots.
  • Exit status is non-zero on incomplete/error copies — check it in scripts.
  • oflag=direct can fail on some filesystems/devices; drop it if dd errors immediately.

Additional Resources

  • man dd
  • info coreutils 'dd invocation'