Linux – Why ‘dd’ Does Not Work for Creating Bootable USB

Writing small amounts of data to a drive is slow, so system buffers writes to commit them all at once later. When the buffer contains enough data for an efficient write operation or when some process uses sync system call, the buffer is flushed to device.

dd performs a low-level copy, ie. it reads data that is physically present on a device. It doesn't take buffers into account.

If the drive was mounted when you ran dd bs=4M, then it's possible that some writes were already buffered, but not commited. You have dumped the drive without buffered changes.

umount calls sync internally to ensure data integrity. Unmounted devices usually aren't accessed unless you explicitly ask some process to do it, so the drive was unlikely to change after unmounting.

Then you ran dd twice on the drive without mounting it in-between. That's why bs=8M and bs=16M calls produced same results.

Drive was modified between bs=4M and bs=8M calls, though, so the first dump is different. bs= didn't matter, calling umount did.

You should always unmount device before using dd on it, otherwise some other process may modify its contents while dd is doing its job and break file integrity.