Cloning hard drives or partitions in Linux serves various purposes such as data backup, replicating an existing system to another location, or conducting non-destructive hard drive forensics. In the latter case, a disk or partition is cloned, and the forensic analysis is carried out on the cloned image, preserving the original data intact.

There are several tools in Linux for cloning hard drives and partitions, including Partimage, Partclone, Clonezilla, and dd. Among these, dd is the most straightforward tool and comes pre-installed in most Linux distributions. It is specifically designed to copy a disk or partition on a block-level basis directly to another disk, partition, or file.

Steps to clone hard drive and partition using dd:

  1. Inspect the installed disks and partitions.
    $ lsblk
    loop0    7:0    0 88.5M  1 loop /snap/core/7270
    loop1    7:1    0 54.1M  1 loop /snap/lxd/10972
    loop2    7:2    0 89.4M  1 loop /snap/core/6818
    loop3    7:3    0 54.1M  1 loop /snap/lxd/11098
    loop4    7:4    0 89.3M  1 loop /snap/core/6673
    sda      8:0    0   20G  0 disk
    ├─sda1   8:1    0    1M  0 part
    └─sda2   8:2    0   20G  0 part /
    sdb      8:16   0    5G  0 disk
    └─sdb1   8:17   0    5G  0 part /mnt/data
    sr0     11:0    1  748M  0 rom

    For this example, we're going to clone the sdb1 partition to an image file.

  2. Examine the source disk and partition information.

    From the above lsblk output, sdb1 is a 5GB partition mounted on /mnt/data.

  3. Ensure the source and target (if target is another disk or partition) are not mounted or in use.
    $ sudo umount --force /dev/sdb1
  4. Confirm that the target disk or partition has sufficient storage space to accommodate the source data.
    $ df -h /dev/sda2
    Filesystem      Size  Used Avail Use% Mounted on
    /dev/sda2        20G  5.2G   14G  28% /

    Target disk drive or partition needs to have at least the same capacity, and mounted partition for the target file needs to have enough free disk space. In this case, our target mounted partition still have 14GB available for the required 5GB.

  5. Use dd to clone the hard drive or partition.
    $ sudo dd if=/dev/sdb1 of=/root/sdb1-backup.img conv=noerror,sync status=progress
    [sudo] password for user:
    5347731456 bytes (5.3 GB, 5.0 GiB) copied, 49 s, 109 MB/s
    10483712+0 records in
    10483712+0 records out
    5367660544 bytes (5.4 GB, 5.0 GiB) copied, 49.2271 s, 109 MB/s

    Cloning an entire disk will also clone the master boot record and partition table

  6. Check the cloned image.
    $ sudo file /root/sdb1-backup.img
    /root/sdb1-backup.img: Linux rev 1.0 ext4 filesystem data, UUID=d430e0a1-ec3e-4bed-b16a-e2d35d0f4ed6 (extents) (64bit) (large files) (huge files)
Discuss the article:

Comment anonymously. Login not required.