Mdthbs

How to Check all AD userers for "blank" password?

How big are the Choedan Kal?

Why aren’t there water shutoff valves for each room?

Graphs for which a calculus student can reasonably compute the arclength

Can lodestones be used to magnetize crude iron weapons?

Word for an event that will likely never happen again

What is a good class if we remove subclasses?

Do Reform Jews believe in a theistic God?

Concat Loop Results to determine if contains value

How do some PhD students get 10+ papers? Is that what I need for landing good faculty position?

PhD advisor lost funding, need advice

Why are Tucker and Malcolm not dead?

Using hearing aids on the sabbath?

Why command hierarchy, if the chain of command is standing next to each other?

What are these funnel-looking green things in my yard?

Running code generated in realtime in JavaScript with eval()

Simplification of numbers

Why does my purified Pokémon need to be healed?

Are there really no countries that protect Freedom of Speech as the United States does?

Are employers legally allowed to pay employees in goods and services equal to or greater than the minimum wage?

What is the difference between 王 and 皇?

Do I have to cite common CS algorithms?

Why is there a large performance impact when looping over an array over 240 elements?

Help, I cannot decide when to start the story

How make an image of my entire usb flash drive?

Is there a way to determine the optimal value for the bs parameter to dd?Where are my copied files?Best linux recovery tool for deleted files from USB flash drive?cannot mount usbI can't access my USB device after mkfs.ntfs commandUSB flash drive formatted as “Linux Live CD” keeps the CD-ROM name after re-partitioningSet removable media (USB drive) permissions to a specific groupHow do I plug in a usb-drive?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}

5

1

The message below comes from another post and I tried it the way that they stated to. First, I mounted the usb drive:

sudo mount -o ro,noexec /dev/sdb1 /media

I mounted it as read-only to prevent any damage or changes to the usb while copying it, especially if I mixed up if and of. In the message below, I'm not sure if they wanted to me to use sdb or sdb# for if.

Before trying any recovery I would save the current state by backing up the whole device block by block: dd if=/dev/sdb bs=16M of=/somelargedisk/rawusbdrive where /dev/sdb is your USB drive (check which one by using lsblk) and /somelargedisk/rawusbdrive is a path and filename you choose on a disk/partition with lots of space. Then, if a recovery tool that writes to the disk makes more damage than repairing, you can go back (exchange if and of fields)."

usb

share

edited 14 hours ago

roaima

48.7k77 gold badges6363 silver badges131131 bronze badges

asked 15 hours ago

hddfsck777hddfsck777

2955 bronze badges

New contributor

hddfsck777 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you're dd-ing the drive, why do you mount it at all? sdb1 is a partition, sdb is the whole disk.
  
  – Kusalananda♦
  15 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Kusalananda Simply, since the image is coming from a flash drive, I thought it had to be mounted like all usb's usually are. Thx.
  
  – hddfsck777
  15 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Kusalananda Since the usb 'was' mounted for the original dd, do you think that I made the usb less likely to be able to retrieve the deleted, stolen files from it? Thx.
  
  – hddfsck777
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Ned64 addressed this in a comment (to a degree). Please don't ask follow-up questions in comments. This is not a discussion forum. Your question should be answerable with finality. Additional questions should be new questions.
  
  – Kusalananda♦
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Kusalananda ok, good to know.
  
  – hddfsck777
  12 hours ago
  

  
  
  
  

add a comment | 

5

1

The message below comes from another post and I tried it the way that they stated to. First, I mounted the usb drive:

sudo mount -o ro,noexec /dev/sdb1 /media

I mounted it as read-only to prevent any damage or changes to the usb while copying it, especially if I mixed up if and of. In the message below, I'm not sure if they wanted to me to use sdb or sdb# for if.

Before trying any recovery I would save the current state by backing up the whole device block by block: dd if=/dev/sdb bs=16M of=/somelargedisk/rawusbdrive where /dev/sdb is your USB drive (check which one by using lsblk) and /somelargedisk/rawusbdrive is a path and filename you choose on a disk/partition with lots of space. Then, if a recovery tool that writes to the disk makes more damage than repairing, you can go back (exchange if and of fields)."

usb

share

edited 14 hours ago

roaima

48.7k77 gold badges6363 silver badges131131 bronze badges

asked 15 hours ago

hddfsck777hddfsck777

2955 bronze badges

New contributor

hddfsck777 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you're dd-ing the drive, why do you mount it at all? sdb1 is a partition, sdb is the whole disk.
  
  – Kusalananda♦
  15 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Kusalananda Simply, since the image is coming from a flash drive, I thought it had to be mounted like all usb's usually are. Thx.
  
  – hddfsck777
  15 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Kusalananda Since the usb 'was' mounted for the original dd, do you think that I made the usb less likely to be able to retrieve the deleted, stolen files from it? Thx.
  
  – hddfsck777
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Ned64 addressed this in a comment (to a degree). Please don't ask follow-up questions in comments. This is not a discussion forum. Your question should be answerable with finality. Additional questions should be new questions.
  
  – Kusalananda♦
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Kusalananda ok, good to know.
  
  – hddfsck777
  12 hours ago
  

  
  
  
  

add a comment | 

The message below comes from another post and I tried it the way that they stated to. First, I mounted the usb drive:

sudo mount -o ro,noexec /dev/sdb1 /media

I mounted it as read-only to prevent any damage or changes to the usb while copying it, especially if I mixed up if and of. In the message below, I'm not sure if they wanted to me to use sdb or sdb# for if.

Before trying any recovery I would save the current state by backing up the whole device block by block: dd if=/dev/sdb bs=16M of=/somelargedisk/rawusbdrive where /dev/sdb is your USB drive (check which one by using lsblk) and /somelargedisk/rawusbdrive is a path and filename you choose on a disk/partition with lots of space. Then, if a recovery tool that writes to the disk makes more damage than repairing, you can go back (exchange if and of fields)."

usb

share

edited 14 hours ago

roaima

48.7k77 gold badges6363 silver badges131131 bronze badges

asked 15 hours ago

hddfsck777hddfsck777

2955 bronze badges

New contributor

hddfsck777 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

sudo mount -o ro,noexec /dev/sdb1 /media

share

edited 14 hours ago

roaima

48.7k77 gold badges6363 silver badges131131 bronze badges

asked 15 hours ago

hddfsck777hddfsck777

2955 bronze badges

New contributor

hddfsck777 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share

edited 14 hours ago

roaima

48.7k77 gold badges6363 silver badges131131 bronze badges

asked 15 hours ago

hddfsck777hddfsck777

2955 bronze badges

New contributor

hddfsck777 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

edited 14 hours ago

roaima

48.7k77 gold badges6363 silver badges131131 bronze badges

edited 14 hours ago

roaima

48.7k77 gold badges6363 silver badges131131 bronze badges

asked 15 hours ago

hddfsck777hddfsck777

2955 bronze badges

New contributor

hddfsck777 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 15 hours ago

hddfsck777hddfsck777

2955 bronze badges

2 Answers
2

active

oldest

votes

4

The best way to back up a whole drive is via dd because you can control buffer size for block devices better than with cat. While the USB drive is not mounted, please run, as root:

  dd if=/dev/sdb bs=16M of=/somelargedisk/rawusbdrive

where /dev/sdb is your USB drive (check which one by using lsblk) and /somelargedisk/rawusbdrive is a path and filename you choose on a disk/partition with lots of space.

You can restore that backup by exchanging if and of arguments to dd.

Please note: dd can easily overwrite all your data beyond repair (with reasonable effort) if you get the parameters wrong!

This was first mentioned in my comment to your other question
Best linux recovery tool for deleted files from USB flash drive?

share|improve this answer

answered 15 hours ago

Ned64Ned64

3,23411 gold badge1616 silver badges4242 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, as my question directly comes from your reply, thanks. I am very comfortable with dd now, the 'if' starts with where the files are now (ie: usb), and the 'of' is the destination for the image. And I check my 'dd' command 100 times to be sure before hitting enter! Originally, I don't think we spoke about mounting or not mounting, if I recall correctly. I can redo it. Thanks.
  
  – hddfsck777
  15 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Any way to check the authenticity of the (new) image created, to make sure it is not corrupted? Thx.
  
  – hddfsck777
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @hddfsck777 The data is usually copied without error. If you are unsure you could copy the data again, to a second file, and run sha256sum on both, then compare the hashes (or run diff -qs /somelargedisk/rawusbdrive /somelargedisk/rawusbdrive2). The files may differ if you have mounted the disk in between.
  
  – Ned64
  14 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Probably faster with cat /dev/sdb >/somelargedisk/rawusbdrive though. And easier to remember than dd.
  
  – roaima
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @roaima I do not think that cat would be faster as it would probably buffer with 512 Bytes as opposed to 16MiB specified by dd here. Many drives read and write faster with medium buffer sizes.
  
  – Ned64
  14 hours ago
  

  
  
  
  

 | 
show 9 more comments

4

/dev/sdb is the entire USB disk, and /dev/sdb1 is a partition on the disk. If you want to image the entire disk, you want /dev/sdb.

That said, mounting as read-only isn't going to help you any in this case. You're bypassing the filesystem (which is where the read-only effect is) and working directly with the block device. So if you mix up i and o, you'll trash the disk anyway.

There isn't much benefit to dd here, you might just as well use cat:

sudo cat /dev/sdb > /somelargedisk/rawusbdrive

(Or pv for a nice progress display.)

share|improve this answer

answered 15 hours ago

murumuru

43.7k55 gold badges110110 silver badges181181 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  what happens if cat dies with an i/o error? you keep both pieces? try again to read the damaged blicks
  
  – pizdelect
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Both cat and dd will fail from an Input / Output error. ddrescure was made for the purpose of continuing on after errors if that's what's happening.
  
  – Alex Cannon
  2 hours ago
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

hddfsck777 is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f535323%2fhow-make-an-image-of-my-entire-usb-flash-drive%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

4

The best way to back up a whole drive is via dd because you can control buffer size for block devices better than with cat. While the USB drive is not mounted, please run, as root:

  dd if=/dev/sdb bs=16M of=/somelargedisk/rawusbdrive

where /dev/sdb is your USB drive (check which one by using lsblk) and /somelargedisk/rawusbdrive is a path and filename you choose on a disk/partition with lots of space.

You can restore that backup by exchanging if and of arguments to dd.

Please note: dd can easily overwrite all your data beyond repair (with reasonable effort) if you get the parameters wrong!

This was first mentioned in my comment to your other question
Best linux recovery tool for deleted files from USB flash drive?

share|improve this answer

answered 15 hours ago

Ned64Ned64

3,23411 gold badge1616 silver badges4242 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, as my question directly comes from your reply, thanks. I am very comfortable with dd now, the 'if' starts with where the files are now (ie: usb), and the 'of' is the destination for the image. And I check my 'dd' command 100 times to be sure before hitting enter! Originally, I don't think we spoke about mounting or not mounting, if I recall correctly. I can redo it. Thanks.
  
  – hddfsck777
  15 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Any way to check the authenticity of the (new) image created, to make sure it is not corrupted? Thx.
  
  – hddfsck777
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @hddfsck777 The data is usually copied without error. If you are unsure you could copy the data again, to a second file, and run sha256sum on both, then compare the hashes (or run diff -qs /somelargedisk/rawusbdrive /somelargedisk/rawusbdrive2). The files may differ if you have mounted the disk in between.
  
  – Ned64
  14 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Probably faster with cat /dev/sdb >/somelargedisk/rawusbdrive though. And easier to remember than dd.
  
  – roaima
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @roaima I do not think that cat would be faster as it would probably buffer with 512 Bytes as opposed to 16MiB specified by dd here. Many drives read and write faster with medium buffer sizes.
  
  – Ned64
  14 hours ago
  

  
  
  
  

 | 
show 9 more comments

4

The best way to back up a whole drive is via dd because you can control buffer size for block devices better than with cat. While the USB drive is not mounted, please run, as root:

  dd if=/dev/sdb bs=16M of=/somelargedisk/rawusbdrive

where /dev/sdb is your USB drive (check which one by using lsblk) and /somelargedisk/rawusbdrive is a path and filename you choose on a disk/partition with lots of space.

You can restore that backup by exchanging if and of arguments to dd.

Please note: dd can easily overwrite all your data beyond repair (with reasonable effort) if you get the parameters wrong!

This was first mentioned in my comment to your other question
Best linux recovery tool for deleted files from USB flash drive?

share|improve this answer

answered 15 hours ago

Ned64Ned64

3,23411 gold badge1616 silver badges4242 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, as my question directly comes from your reply, thanks. I am very comfortable with dd now, the 'if' starts with where the files are now (ie: usb), and the 'of' is the destination for the image. And I check my 'dd' command 100 times to be sure before hitting enter! Originally, I don't think we spoke about mounting or not mounting, if I recall correctly. I can redo it. Thanks.
  
  – hddfsck777
  15 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Any way to check the authenticity of the (new) image created, to make sure it is not corrupted? Thx.
  
  – hddfsck777
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @hddfsck777 The data is usually copied without error. If you are unsure you could copy the data again, to a second file, and run sha256sum on both, then compare the hashes (or run diff -qs /somelargedisk/rawusbdrive /somelargedisk/rawusbdrive2). The files may differ if you have mounted the disk in between.
  
  – Ned64
  14 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Probably faster with cat /dev/sdb >/somelargedisk/rawusbdrive though. And easier to remember than dd.
  
  – roaima
  14 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @roaima I do not think that cat would be faster as it would probably buffer with 512 Bytes as opposed to 16MiB specified by dd here. Many drives read and write faster with medium buffer sizes.
  
  – Ned64
  14 hours ago
  

  
  
  
  

 | 
show 9 more comments

The best way to back up a whole drive is via dd because you can control buffer size for block devices better than with cat. While the USB drive is not mounted, please run, as root:

  dd if=/dev/sdb bs=16M of=/somelargedisk/rawusbdrive

where /dev/sdb is your USB drive (check which one by using lsblk) and /somelargedisk/rawusbdrive is a path and filename you choose on a disk/partition with lots of space.

You can restore that backup by exchanging if and of arguments to dd.

Please note: dd can easily overwrite all your data beyond repair (with reasonable effort) if you get the parameters wrong!

This was first mentioned in my comment to your other question
Best linux recovery tool for deleted files from USB flash drive?

share|improve this answer

answered 15 hours ago

Ned64Ned64

3,23411 gold badge1616 silver badges4242 bronze badges

  dd if=/dev/sdb bs=16M of=/somelargedisk/rawusbdrive

share|improve this answer

answered 15 hours ago

Ned64Ned64

3,23411 gold badge1616 silver badges4242 bronze badges

answered 15 hours ago

Ned64Ned64

3,23411 gold badge1616 silver badges4242 bronze badges

answered 15 hours ago

Ned64Ned64

3,23411 gold badge1616 silver badges4242 bronze badges

4

/dev/sdb is the entire USB disk, and /dev/sdb1 is a partition on the disk. If you want to image the entire disk, you want /dev/sdb.

That said, mounting as read-only isn't going to help you any in this case. You're bypassing the filesystem (which is where the read-only effect is) and working directly with the block device. So if you mix up i and o, you'll trash the disk anyway.

There isn't much benefit to dd here, you might just as well use cat:

sudo cat /dev/sdb > /somelargedisk/rawusbdrive

(Or pv for a nice progress display.)

share|improve this answer

answered 15 hours ago

murumuru

43.7k55 gold badges110110 silver badges181181 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  what happens if cat dies with an i/o error? you keep both pieces? try again to read the damaged blicks
  
  – pizdelect
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Both cat and dd will fail from an Input / Output error. ddrescure was made for the purpose of continuing on after errors if that's what's happening.
  
  – Alex Cannon
  2 hours ago
  

  
  
  
  

add a comment | 

4

/dev/sdb is the entire USB disk, and /dev/sdb1 is a partition on the disk. If you want to image the entire disk, you want /dev/sdb.

That said, mounting as read-only isn't going to help you any in this case. You're bypassing the filesystem (which is where the read-only effect is) and working directly with the block device. So if you mix up i and o, you'll trash the disk anyway.

There isn't much benefit to dd here, you might just as well use cat:

sudo cat /dev/sdb > /somelargedisk/rawusbdrive

(Or pv for a nice progress display.)

share|improve this answer

answered 15 hours ago

murumuru

43.7k55 gold badges110110 silver badges181181 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  what happens if cat dies with an i/o error? you keep both pieces? try again to read the damaged blicks
  
  – pizdelect
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Both cat and dd will fail from an Input / Output error. ddrescure was made for the purpose of continuing on after errors if that's what's happening.
  
  – Alex Cannon
  2 hours ago
  

  
  
  
  

add a comment | 

/dev/sdb is the entire USB disk, and /dev/sdb1 is a partition on the disk. If you want to image the entire disk, you want /dev/sdb.

That said, mounting as read-only isn't going to help you any in this case. You're bypassing the filesystem (which is where the read-only effect is) and working directly with the block device. So if you mix up i and o, you'll trash the disk anyway.

There isn't much benefit to dd here, you might just as well use cat:

sudo cat /dev/sdb > /somelargedisk/rawusbdrive

(Or pv for a nice progress display.)

share|improve this answer

answered 15 hours ago

murumuru

43.7k55 gold badges110110 silver badges181181 bronze badges

sudo cat /dev/sdb > /somelargedisk/rawusbdrive

share|improve this answer

answered 15 hours ago

murumuru

43.7k55 gold badges110110 silver badges181181 bronze badges

answered 15 hours ago

murumuru

43.7k55 gold badges110110 silver badges181181 bronze badges

answered 15 hours ago

murumuru

43.7k55 gold badges110110 silver badges181181 bronze badges