dd behind the scenes.
About disks and partitions
A whole disk is a device like
/dev/sda. This is the first disk, the second disk is
/dev/sdb, the third
/dev/sdc, etc. Older disks connected through an IDE cable are named like
hdb, ... A disk can have multiple partitions like
/dev/sda1. The second partition on disk
/dev/sda2 and so on. An image (literal copy of bytes) can be made from both a partition and disk. Note that first 512 bytes of a disk contains the MBR (Master Boot Record).
A partition should not be mounted when creating or restoring images, otherwise data loss may occur when reading from it (creating an image) or unexpected bahavior and data corruption if you're writing to it (restoring from a image).
In the below examples,
/dev/sda1 is the partition from which an image should be created.
Partitions and disk devices in
/dev are only writable by the superuser (root) and users of the
disk group. I dislike running everything as root, so for safety (in case you made a typo for example), I change the group temporary to myself, so I can read and write to it:
sudo chgrp my_user_name /dev/sda1
If you skip the above command, you've to prefix the below
dd commands with
The basic command for creating an image from a partition is:
dd if=/dev/sda1 of=disk.img
if means "input file",
of means "output file". Everything in Linux is a file, even devices.
To restore such an image, run:
dd if=disk.img of=/dev/sda1
The order does not matter, you could have written the above as
dd of=/dev/sda1 if=disk.img too.
Since partitions are generally big, it's recommended to compress the data before writing it to the image:
dd if=/dev/sda1 | gzip > disk.img.gz
This works because if
of is omitted, the output is written to "standard output" which is the pipe to the compress program
gzip. The output of that is written to
To restore such a compressed image, run:
gunzip -c disk.img.gz | dd of=/dev/sda1
gunzip is the reverse command of gzip.
-c causes the output be written to standard output which is the pipe to the
dd command. Because
if is omitted on
dd, the input is read from "standard input" which is the output of
Reading from an image without restoring it
Uncompressed images can be mounted so you can read from it. Should you've compressed your partition images, uncompress them first (
disk.img.gz will be removed,
disk.img will be created. Be sure to have enough space!):
Alternatively, uncompress an image without touching the image itself:
gunzip -c disk.img.gz > disk.img
Now create a directory on which the disk can be mounted and mount the image read-only (
sudo mkdir /mnt/wind
sudo mount -o ro disk.img /mnt/wind
You can now view your files in
/mnt/wind. When done, unmount it and remove the obsolete mount point:
sudo umount /mnt/wind
sudo rmdir /mnt/wind
Less size, more CPU usage, longer backup and restore duration
If time is not an issue and you don't have much storage space, you could use the
bzip2 compression format. Simply replace
bzip2 in the above. It's common to use the
.bz2 extension for bzip2-compressed files, so do so.