I'm currently trying to understand some code I have found which unmounts a drive but then does operations onto it (which seems quite strange to me).

The situation is as follows: I have a mount named /dev/sda1 which points to a local hard drive.

Then I have the command unmount /dev/sda*. Next is a command that unzips a file and pipes the result to a ntfsclone:

ntfsclone -r -O /dev/sda1 -

After this there is another unmount /dev/sda*. followed by a dd with the output file being the same folder again: dd of=/dev/sda count=1 bs=.....

So in total its:


all going onto /dev/sda1.

What I'm not understanding here is what is really happening there. I get that the ntfsclone is used to create a clone of the image of the hard drive while dd is used to (re)create the boot partition. What I don't get is the possible reason behind the umounts. Which is in essence my question here:

What are the umounts for / what are they doing there / how does it affect the operations there (as they are going onto unmounted devices as far as I understand the operations there)?

Note I only put in the parameters and codeparts I think are necessary to see what the commands do (thus the dd naturally also has a if parameter, ... .


On one level, the kernel software is able to read and write a disk drive, but only entire blocks and/or sectors. On a higher level, a different piece of software (the file system driver) is able to see these blocks and sectors as a file system, and read and write files and directories. In order for the file system driver to work, a mapping must be made between the physical blocks on the disk and the folder structure. That is called mounting the disk.

However, when copying entire disks, you don't want the file system to change once you have started copying. In order to prevent this you unmount the file system. Now, only the low-level commands are able to access the disk. ntfsclone and dd are examples of low-level commands that guarantee the file system is not changed while they are busy.

| improve this answer | |
  • Ah ok so the confusion of mine there does stem from a misunderstanding of unmount. Thus the unmount does NOT remove the pointer so to say, but only make it unavailable for high level commands. Low level commands still can use the appropriate folders to do their job? – Thomas Dec 16 '15 at 9:17
  • No, low level commands cannot access files and folders on the unmounted disk, only the physical structure. – Jos Dec 16 '15 at 9:31
  • ok got it then tnx! – Thomas Dec 16 '15 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.