dd Command Cheat Sheet

dd (Data Duplicator) is a low-level utility used to copy and convert raw data. It works on files, devices, partitions, and even boot sectors, making it a powerful tool for system administration and forensics.

Synopsis

dd if=INPUT of=OUTPUT [OPERAND]...

if: Input File (source)
of: Output File (destination)
bs: Block Size (bytes to read/write at a time)
count: Number of blocks to copy

Basic Usage

Create a File with Zeros

Create a 100MB file filled with zeros (useful for testing or initializing storage).

dd if=/dev/zero of=testfile.img bs=1M count=100

Create a File with Random Data

dd if=/dev/urandom of=random.bin bs=1M count=10

Backup a Partition

Clone an entire partition to an image file.

dd if=/dev/sda1 of=partition_backup.img bs=4M status=progress

Restore a Partition

dd if=partition_backup.img of=/dev/sda1 bs=4M status=progress

Bootable Media

Create Bootable USB from ISO

Warning: This will erase all data on the USB drive /dev/sdx.

sudo dd if=linux-distro.iso of=/dev/sdx bs=4M status=progress oflag=sync

Tip: Use lsblk to confirm the correct device identifier (e.g., sdb, not sdb1).

Disk Cloning

Clone Entire Disk

Copy everything from Disk A (sda) to Disk B (sdb). Disk B must be larger or equal size.

sudo dd if=/dev/sda of=/dev/sdb bs=64K conv=noerror,sync status=progress

conv=noerror: Continue even if read errors occur.
conv=sync: Pad bad blocks with zeros to keep offsets correct.

Clone MBR (Master Boot Record)

The first 512 bytes of the disk contain the bootloader and partition table (MBR).

# Backup MBR
sudo dd if=/dev/sda of=mbr_backup.bin bs=512 count=1

# Restore MBR
sudo dd if=mbr_backup.bin of=/dev/sda bs=512 count=1

Performance Testing

Test Write Speed

Write data to a file (cached).

dd if=/dev/zero of=testfile bs=1G count=1 oflag=dsync

Test Read Speed

Read data from a file (clearing cache first is recommended).

dd if=testfile of=/dev/null bs=1G

Text Conversion

dd can perform legacy text processing (dating back to mainframe tapes).

Convert Lowercase to Uppercase

dd if=file.txt of=upper.txt conv=ucase

Swap Bytes (Endian conversion)

dd if=file.bin of=swapped.bin conv=swab

Advanced Options

Skipping Blocks

skip=N: Skip N blocks from the input file.
seek=N: Skip N blocks in the output file (creating a sparse file if outputting to file).

Example: Extracting part of a file

Extract 10MB starting from offset 50MB.

dd if=largefile.img of=snippet.img bs=1M skip=50 count=10

Direct I/O (Bypass Cache)

Use iflag=direct or oflag=direct to bypass the OS page cache for accurate benchmarking.

dd if=/dev/zero of=file.bin bs=1M count=1000 oflag=direct

Progress Monitoring

Newer versions of dd (GNU coreutils 8.24+) support status=progress.

dd if=source of=dest status=progress

For older versions, send the USR1 signal to the running dd process ID (PID):

kill -USR1 $(pgrep ^dd$)

This prints the current status to stderr without stopping the process.

Practical Examples

Wipe a Drive Securely

Overwrites the entire drive with zeros.

sudo dd if=/dev/zero of=/dev/sdX bs=4M status=progress

Overwrite with random data (more secure, slower).

sudo dd if=/dev/urandom of=/dev/sdX bs=4M status=progress

Truncate a File

Ideally use truncate command, but dd works too.

dd if=/dev/null of=file.txt seek=10 bs=1M

Creates a 10MB file full of sparse holes (size reported differs from disk usage).

Notes

Block Size (bs): Larger block sizes (e.g., 4M vs 512) generally increase copy speed by reducing system call overhead.
Safety: dd is nicknamed "Disk Destroyer". A typo in of= (Output File) can permanently wipe your system drive. Always triple-check lsblk before running.