Disk Partition – How to Copy Three Partitions with Specific Beginning and Ending Using dd

ddpartitionshell

Using the fdisk -l command I got the following answer:

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048    28266495    14132224   27  Hidden NTFS WinRE
/dev/sda2        28268544    28473343      102400    7  HPFS/NTFS/exFAT
/dev/sda3        28473344   132552703    52039680    7  HPFS/NTFS/exFAT
/dev/sda4   *   132556798   625141759   246292481    5  Extended
/dev/sda5       193996800   198092799     2048000   82  Linux swap / Solaris
/dev/sda6       234960896   625141759   195090432    7  HPFS/NTFS/exFAT
/dev/sda7       198094848   234950316    18427734+  83  Linux
/dev/sda8       132556800   183756018    25599609+  83  Linux

I'd like to copy the three first partitions of my disk in an image using the dd command. So I mounted an external hard drive, entered in its folder and typed:

# dd count=$((132552703-2048)) if=/dev/sda of=./newImage.image

But this command copied all the sda disk to my external hard drive instead of just copying until the end of the sda3 partition.

How can I use the dd to create an image that starts at the beginning of sda1 and finishes at the end of sda3?

Best Answer

first of all, here's how:

  1. First do almost as you did before, but no subtraction - and add one to the count.

    dd  count=132552704 </dev/sda >img

  2. Next print the partition table at a sed process which can screen out the ones which you're removing.

    • sed will write a delete command to a second fdisk which has opened your img file for every partition from sda4 and on.

      fdisk -l img | sed -e'/sda4 /,$id' -e'g;$aw' | fdisk img

  3. There is no 3. You're done.

secondly, here's why:

  • A Partial Success...

    • I'm pretty sure your command almost worked, but I'm willing to bet that it worked better than you think.

    • I expect that when you say it copied all of sda you believe that because an fdisk -l of that image indicated all of the partitions were included within. Based on the dd command in your question, though, provided /dev/sda's sector size is the fairly standard 512 bytes (and therefore identical to dd's default blocksize) then you should have copied everything from byte 0 of /dev/sda only through to all but the last 2k sectors of /dev/sda3.

  • About Sectors...

    • You can see below where the fdisk output reports on Units. That is the size of each sector that fdisk reports on. A disk sector might be 4096-bytes - if it is a very recently manufactured disk and handles the Advanced Format sector-size - otherwise it is very rare to find a disk not partitioned on a standard logical 512-byte sector-size.

    • This is how fdisk's man page puts it:

    • -u, --units[=unit]

      • When listing partition tables, show sizes in sectors or in cylinders. The default is to show sizes in sectors. For backward compatibility, it is possible to use the option without the unit argument - then the default is used. Note that the optional unit argument cannot be separated from the -u option by a space, the correct form is for example -u=cylinders.

    • There's more on this here.

  • And something about dd, too...

    • dd cannot silently lose data. In fact, if a short read occurs, dd is specified to be very vocal about it:

    • A partial input block is one for which read() returned less than the input block size. A partial output block is one that was written with fewer bytes than specified by the output block size...

    • ...when there is at least one truncated block, the number of truncated blocks shall be written to standard error...

    • "%u truncated %s\n", <number of truncated blocks>, "record[s]"

  • Block i/o...

    • But anyway, that actually can't happen with block-device i/o. It's what makes a block-device a block-device - there's an extra layer (sometimes several) of buffered protection for block-devices as opposed to character devices. It is this distinction which enables POSIX to guarantee lseek() for files existing on block-devices - it's a very basic principle of blocked i/o.

  • To sum up...

    • And so you have copied all of your device up to the point you specified, but the thing is, the first 2k sectors of /dev/sda will contain its entire partition table, and as such you would have copied said partition table to your image, and so an fdisk -l of your image would report for all partitions of /dev/sda, whether or not the data for those partitions actually resides within that image-file. You can, instead, of course, just cat the separate data partitions separately into separate image files if you like - but in that case you lose the partition table entirely. All you really have to do is delete the partitions which you did not copy, and make sure you copy all of those you do.

third, here's how I know:

  • This will create an 4G ./img file full of NULs.

    </dev/zero >./img \
dd ibs=8k obs=8kx1b count=1kx1b 

    524288+0 records in
1024+0 records out
4294967296 bytes (4.3 GB) copied, 3.53287 s, 1.2 GB/s

  • This will partition ./img to match your disk up to the first three partitions but on a 1/16th scale:

    (set "$((p=0))" 28266495     27 \
      28268544  28473343  2\\n7 \
      28473344 132552703  3\\n7
while   [ "$#" -ge "$((p+=1))" ]
do      printf "n\np\n$p\n%.0d\n%d\nt\n%b\n" \
               "$(($1/16))" "$(($2/16))" "$3"
        shift 3
done;   echo w
)| fdisk ./img >/dev/null

  • And so now we can look at it.

    fdisk -l ./img

    Disk ./img: 4 GiB, 4294967296 bytes, 8388608 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x5659b81c

Device     Boot   Start     End Sectors   Size Id Type
./img1             2048 1766655 1764608 861.6M 27 Hidden NTFS WinRE
./img2          1766784 1779583   12800   6.3M  7 HPFS/NTFS/exFAT
./img3          1779584 8284543 6504960   3.1G  7 HPFS/NTFS/exFAT

  • I'll also put some actual filesystems and files on the three partitions.

    sudo sh -c ' trap "$1" 0
    cd /tmp; mkdir -p mnt
    for p in "$(losetup --show -Pf "$0")p"*
    do    mkfs.vfat "$p"
          mount "$p" mnt
          echo  "my part# is ${p##*p}" \
                 >./mnt/"part${p##*p}"
          sync; umount mnt
    done' "$PWD/img" 'losetup -D'

  • Here are the byte offsets for where it all wound up...

    grep -Ebao '(my[^0-9]*|PART)[123]' <./img

    2826272:PART1
2830336:my part# is 1
904606240:PART2
904624640:my part# is 2
917656608:PART3
917660672:my part# is 3

But did you notice that fdisk was perfectly happy to report on the partitions' sizes before ever we formatted them with filesystems? This is because the partition table lies at the very head of the disk - it's only a layout and nothing more. None of the partitions need actually exist to be reported. They're only logically mapped out within the first 1M of ./img. Watch:

  • Let's try getting only the first two partitions off of ./img...

    <./img >./img2 dd count=1779583

    1779583+0 records in
1779583+0 records out
911146496 bytes (911 MB) copied, 1.84985 s, 493 MB/s

  • We'll grep it again...

    grep -Ebao '(my[^0-9]*|PART)[123]' <./img2

    2826272:PART1
2830336:my part# is 1
904606240:PART2
904624640:my part# is 2

  • And get an fdisk report...

    fdisk -l ./img2

    Disk ./img2: 869 MiB, 911146496 bytes, 1779583 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xcbcab4d8

Device     Boot   Start     End Sectors   Size Id Type
./img2p1           2048 1766655 1764608 861.6M 27 Hidden NTFS WinRE
./img2p2        1766784 1779583   12800   6.3M  7 HPFS/NTFS/exFAT
./img2p3        1779584 8284543 6504960   3.1G  7 HPFS/NTFS/exFAT

Now that is curious. fdisk still seems to believe there's a third partition extending as far out as 4G for a disk which it also seems to believe is only 869M in size!

  • Probably we should remove that third partition from the partition table.

    printf %s\\n d 3 w |
fdisk ./img2 >/dev/null

  • And now lets see if we can mount the partitions we copied and if our files remain in tact...

    sudo sh -c ' trap "$1" 0
    cd /tmp; mkdir -p mnt
    for p in "$(losetup --show -Pf "$0")p"*
    do    mount "$p" mnt
          grep . /dev/null ./mnt/*
          umount mnt
    done' "$PWD/img2" 'losetup -D'

    ./mnt/part1:my part# is 1
./mnt/part2:my part# is 2

Apparently it's not impossible.

Related Question