LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-07-2019, 05:39 AM   #1
dezix
Member
 
Registered: Sep 2017
Location: Frog's Land
Distribution: Debian
Posts: 98

Rep: Reputation: Disabled
dd : Basic behaviour not what expected


I know the Learn the DD command page here in LQ
and
I have read the FM ;-)

But I can't understand something very basic with DD

Let me show an example :

Here an USB stick with a dos parts table, 1 NFS part with some Files written onto

Code:
Disque /dev/sdb : 14,9 GiB, 16008609792 octets, 31266816 secteurs
Modèle de disque : Cruzer Slice
Unités : secteur de 1 × 512 = 512 octets
Taille de secteur (logique / physique) : 512 octets / 512 octets
taille d'E/S (minimale / optimale) : 512 octets / 512 octets
Type d'étiquette de disque : dos
Identifiant de disque : 0x064a5b05

Périphérique Amorçage Début      Fin Secteurs Taille Id Type
/dev/sdb1              2048 31266815 31264768  14,9G  7 HPFS/NTFS/exFAT
Now I dd the first 512 B to create a backup image of the MBR

Code:
# dd if=/dev/sdb of=mbr.img bs=512 count=1 conv=noerror,sync
1+0 enregistrements lus
1+0 enregistrements écrits
512 octets copiés, 0,00278143 s, 184 kB/s
After I use the following command :

Code:
# dd if=mbr.img of=/dev/sdb bs=512
1+0 enregistrements lus
1+0 enregistrements écrits
512 octets copiés, 0,00326331 s, 157 kB/s
According to my understanding of the dd FM
I would have an empty pen drive with the same NTFS part,
but the files are still here.

Normaly I should use :

Code:
# dd if=mbr.img of=/dev/sdb bs=512 conv=notrunc
to get this result.

So, please someone might tell me where I'm wrong ?

Thanks.

If that matters I'm running Bash on Debian Testing
Code:
$ uname -sro
Linux 4.19.0-5-amd64 GNU/Linux


$ bash --version
GNU bash, version 5.0.3(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2019 Free Software Foundation, Inc.
Licence GPLv3+ : GNU GPL version 3 ou ultérieure <http://gnu.org/licenses/gpl.html>


$ dd --version
dd (coreutils) 8.30
Copyright © 2018 Free Software Foundation, Inc.
License GPLv3+ : GNU GPL version 3 ou ultérieure <https://www.gnu.org/licenses/gpl.fr.html>
Ceci est un logiciel libre. Vous êtes libre de le modifier et de le redistribuer.
Ce logiciel n'est accompagné d'ABSOLUMENT AUCUNE GARANTIE, dans les limites
permises par la loi.
Écrit par Paul Rubin, David MacKenzie et Stuart Kemp.
 
Old 06-07-2019, 06:00 AM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,103

Rep: Reputation: 4117Reputation: 4117Reputation: 4117Reputation: 4117Reputation: 4117Reputation: 4117Reputation: 4117Reputation: 4117Reputation: 4117Reputation: 4117Reputation: 4117
All you have done is copy one sector, then write the same data back. Why would you think that would affect your files (or the filesystem) that exist elsewhere on the disk ?. The partition table merely defines the start and length of each partition - nothing more.
 
Old 06-07-2019, 06:03 AM   #3
berndbausch
LQ Addict
 
Registered: Nov 2013
Location: Tokyo
Distribution: Mostly Ubuntu and Centos
Posts: 6,316

Rep: Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002
Quote:
Originally Posted by dezix View Post
After I use the following command :

Code:
# dd if=mbr.img of=/dev/sdb bs=512
1+0 enregistrements lus
1+0 enregistrements écrits
512 octets copiés, 0,00326331 s, 157 kB/s
According to my understanding of the dd FM
I would have an empty pen drive with the same NTFS part,
but the files are still here.
After this dd command, the first 512 bytes of the disk have exactly the same content as before the command. In other words, the disk's content hasn't changed. Why do you expect that your files disappear?
Quote:
Normaly I should use :

Code:
# dd if=mbr.img of=/dev/sdb bs=512 conv=notrunc
to get this result.
I think I understand your reasoning now. If /dev/sdb were a regular file, it would be truncated. But it is a device file, which can't be truncated.
 
1 members found this post helpful.
Old 06-07-2019, 06:08 AM   #4
hazel
LQ Guru
 
Registered: Mar 2016
Location: Harrow, UK
Distribution: LFS, AntiX, Slackware
Posts: 7,494
Blog Entries: 19

Rep: Reputation: 4410Reputation: 4410Reputation: 4410Reputation: 4410Reputation: 4410Reputation: 4410Reputation: 4410Reputation: 4410Reputation: 4410Reputation: 4410Reputation: 4410
The files are still there because you haven't altered the part of the disk they are on. You've only rewritten the MBR. And since the new MBR is identical to the old one, the partition table inside it will still allow the kernel to find out where the first partition starts and so find the files.

Also, according to https://stackoverflow.com/questions/...a-disk-with-dd, the notrunc option doesn't affect device files.
 
Old 06-07-2019, 09:16 AM   #5
dezix
Member
 
Registered: Sep 2017
Location: Frog's Land
Distribution: Debian
Posts: 98

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by berndbausch View Post
After this dd command, the first 512 bytes of the disk have exactly the same content as before the command. In other words, the disk's content hasn't changed. Why do you expect that your files disappear?

I think I understand your reasoning now. If /dev/sdb were a regular file, it would be truncated. But it is a device file, which can't be truncated.
OK! I understand that.

But there is no mention of such behaviour in the FM

Is there other kinds of exception that basic user should be aware ?
 
Old 06-07-2019, 10:07 AM   #6
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,685

Rep: Reputation: 7274Reputation: 7274Reputation: 7274Reputation: 7274Reputation: 7274Reputation: 7274Reputation: 7274Reputation: 7274Reputation: 7274Reputation: 7274Reputation: 7274
this is not an exception, this is how things work.
If you write a file (in a filesystem) the size will be determined based on the data you write into it. dd, copy and a lot of other tools will remove your original file and create a new one (= overwrite).
But if you write data directly onto a physical device you cannot remove/overwrite files but simply overwrite blocks on the device. Obviously non-touched blocks will not be affected.

It is your own decision [a basic user should be aware of] if you dd into a file on a filesystem or on a device - without using any filesystem.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
SCSI I/O counters and SATA drives - expected behaviour? EngimaTiger Linux - Kernel 3 08-26-2012 12:43 PM
Basic Very Basic ? Helen Hatton Linux - Newbie 12 01-04-2009 03:57 PM
GnuCash, KMyMoney - basic, basic questions - please help if you can. brjoon1021 Linux - Software 3 10-20-2008 06:27 PM
SLES 8 Disk2 and Disk3 not used - expected behaviour hello321_1999 Linux - Software 0 11-09-2004 11:26 AM
I'm a BASIC chap, looking for some info on BASIC programming CragStar Programming 2 01-21-2001 09:19 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 04:20 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration