Cloning hard drives or partitions in Linux serves various purposes such as data backup, replicating an existing system to another location, or conducting non-destructive hard drive forensics. In the latter case, a disk or partition is cloned, and the forensic analysis is carried out on the cloned image, preserving the original data intact.
There are several tools in Linux for cloning hard drives and partitions, including Partimage, Partclone, Clonezilla, and dd. Among these, dd is the most straightforward tool and comes pre-installed in most Linux distributions. It is specifically designed to copy a disk or partition on a block-level basis directly to another disk, partition, or file.
$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 88.5M 1 loop /snap/core/7270 loop1 7:1 0 54.1M 1 loop /snap/lxd/10972 loop2 7:2 0 89.4M 1 loop /snap/core/6818 loop3 7:3 0 54.1M 1 loop /snap/lxd/11098 loop4 7:4 0 89.3M 1 loop /snap/core/6673 sda 8:0 0 20G 0 disk ├─sda1 8:1 0 1M 0 part └─sda2 8:2 0 20G 0 part / sdb 8:16 0 5G 0 disk └─sdb1 8:17 0 5G 0 part /mnt/data sr0 11:0 1 748M 0 rom
For this example, we're going to clone the sdb1 partition to an image file.
From the above lsblk output, sdb1 is a 5GB partition mounted on /mnt/data.
$ sudo umount --force /dev/sdb1
$ df -h /dev/sda2 Filesystem Size Used Avail Use% Mounted on /dev/sda2 20G 5.2G 14G 28% /
Target disk drive or partition needs to have at least the same capacity, and mounted partition for the target file needs to have enough free disk space. In this case, our target mounted partition still have 14GB available for the required 5GB.
$ sudo dd if=/dev/sdb1 of=/root/sdb1-backup.img conv=noerror,sync status=progress [sudo] password for user: 5347731456 bytes (5.3 GB, 5.0 GiB) copied, 49 s, 109 MB/s 10483712+0 records in 10483712+0 records out 5367660544 bytes (5.4 GB, 5.0 GiB) copied, 49.2271 s, 109 MB/s
Cloning an entire disk will also clone the master boot record and partition table
$ sudo file /root/sdb1-backup.img /root/sdb1-backup.img: Linux rev 1.0 ext4 filesystem data, UUID=d430e0a1-ec3e-4bed-b16a-e2d35d0f4ed6 (extents) (64bit) (large files) (huge files)
Comment anonymously. Login not required.