0

I'm trying to get a specific data from the disk starting at specific address (don't know if it was physical address or not, ex: 0x00000000DA88FFFF, with size 0x5776). Actually I'm new with disk imager and these stuff and I found that dd command is suitable for making disk images, but I couldn't found anything related to start imaging from specific addresses with a specific size, is there anyway to do this? I want to extract a specific information from the disk.

2 Answers 2

0

dd has the skip parameter allowing you to skip a portion at the start of the input.

Thing is, dd reads a block at a time, reading a block into memory then writing that block to the output, then repeating. If the number of bytes you want to skip is not a multiple of the default block size (512) then you'll need to set block size. The following would work:

dd if=/dev/sda1 bs=1 skip=3666411519 count=22390 of=/some/file

In that case you're setting block size to a single byte (because your skip value is arbitrary and not a multiple of anything in particular).

Using a block size of 1 byte will be relatively slow but if you're only reading about 22kB it's not a huge problem.

2
  • it's more clear for me now, but still have some points, if I need to start dd from a specific address, how to start there? the conversion between skip and the addresses, second, if I need around 1kB, how to specify this?
    – Aziz
    Dec 19, 2017 at 5:40
  • The address you had beginning with 0x was in hexadecimal. Convert to decimal with this tool. 1kB is 1024 bytes. Dec 19, 2017 at 22:27
0

dd has a skip flag:

skip=N skip N ibs-sized blocks at start of input

But the address then has to be N*ibs. But 0x00000000DA88FFFF = 3×1222137173, which doesn't seem a reasonable starting point. In general, you could do:

dd ibs=X start=Y count=Z if=/some/disk

To copy Z*X bytes starting from Y*X.

4
  • What is ibs? input bytes? and the count specify the byte number will be read? it's more clear but still have no idea how to put the address in the start? how to convert it? convert it to what? at this point am lost
    – Aziz
    Dec 19, 2017 at 5:51
  • @Aziz see manpage: manpages.ubuntu.com/manpages/zesty/en/man1/dd.1.html As I said, if start=Y and ibs=X, then it starts reading from bytes Y*X. What part of that is unclear?
    – Olorin
    Dec 19, 2017 at 6:13
  • start=Y (ex. Y=0x00000000DA88FFFF) , should I put it in this form? and for the ibs= 1b, just the address how to put it ??
    – Aziz
    Dec 19, 2017 at 6:23
  • @Aziz you haven't said what your address actually is, and you don't even know what it is or what it's supposed to mean, so how can I answer that?
    – Olorin
    Dec 19, 2017 at 6:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .