How to clone hard drives and partitions in Linux

Cloning hard drives or partitions in Linux serves various purposes such as data backup, replicating an existing system to another location, or conducting non-destructive hard drive forensics. In the latter case, a disk or partition is cloned, and the forensic analysis is carried out on the cloned image, preserving the original data intact.

There are several tools in Linux for cloning hard drives and partitions, including Partimage, Partclone, Clonezilla, and dd. Among these, dd is the most straightforward tool and comes pre-installed in most Linux distributions. It is specifically designed to copy a disk or partition on a block-level basis directly to another disk, partition, or file.

1. Inspect the installed disks and partitions.

   $ lsblk
   NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
   loop0    7:0    0 88.5M  1 loop /snap/core/7270
   loop1    7:1    0 54.1M  1 loop /snap/lxd/10972
   loop2    7:2    0 89.4M  1 loop /snap/core/6818
   loop3    7:3    0 54.1M  1 loop /snap/lxd/11098
   loop4    7:4    0 89.3M  1 loop /snap/core/6673
   sda      8:0    0   20G  0 disk
   ├─sda1   8:1    0    1M  0 part
   └─sda2   8:2    0   20G  0 part /
   sdb      8:16   0    5G  0 disk
   └─sdb1   8:17   0    5G  0 part /mnt/data
   sr0     11:0    1  748M  0 rom

   For this example, we're going to clone the sdb1 partition to an image file.

2. Examine the source disk and partition information.

   From the above lsblk output, sdb1 is a 5GB partition mounted on /mnt/data.

3. Ensure the source and target (if target is another disk or partition) are not mounted or in use.

   $ sudo umount --force /dev/sdb1

4. Confirm that the target disk or partition has sufficient storage space to accommodate the source data.

   $ df -h /dev/sda2
   Filesystem      Size  Used Avail Use% Mounted on
   /dev/sda2        20G  5.2G   14G  28% /

   Target disk drive or partition needs to have at least the same capacity, and mounted partition for the target file needs to have enough free disk space. In this case, our target mounted partition still have 14GB available for the required 5GB.

5. Use dd to clone the hard drive or partition.

   $ sudo dd if=/dev/sdb1 of=/root/sdb1-backup.img conv=noerror,sync status=progress
   [sudo] password for user:
   5347731456 bytes (5.3 GB, 5.0 GiB) copied, 49 s, 109 MB/s
   10483712+0 records in
   10483712+0 records out
   5367660544 bytes (5.4 GB, 5.0 GiB) copied, 49.2271 s, 109 MB/s

   Cloning an entire disk will also clone the master boot record and partition table

6. Check the cloned image.

   $ sudo file /root/sdb1-backup.img
   /root/sdb1-backup.img: Linux rev 1.0 ext4 filesystem data, UUID=d430e0a1-ec3e-4bed-b16a-e2d35d0f4ed6 (extents) (64bit) (large files) (huge files)