Reading from the end of a drive with dd

Question

How can I read from the end of a drive with dd? I thought about using size - to_read but I have no idea how to get the size in bytes.

Answer 1

Get a total size of a disk, in bytes:

fdisk -l /dev/sda  

Disk /dev/sda: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1           7       56196   fd  Linux raid autodetect
/dev/sda2               8         257     2008125   83  Linux
/dev/sda3             258      121602   974698231+  fd  Linux raid autodetect  

Get last 100 bytes from the disk with dd:

  dd if=/dev/sda of=/tmp/endofdisk.data bs=1 skip=1000204885916 count=100
  

Notice the total size of disk on the first line of fdisk output. I used 1-byte block size, but of course if you're copying more than a couple of bytes, use 1K or 1M blocks. Calculate the size manually (divide by 1024) and replace bs=1 with bs=1024 for 1K blocks.

Answer 2

Does it have to be 'dd'? GNU 'ddrescue' has a convenient "reverse" option:

  # copy the last 1K from '/dev/sdc' to '/tmp/c_end'
  % ddrescue  --reverse  --max-size=1Ki /dev/sdc /tmp/c_end


  Press Ctrl-C to interrupt
  rescued:      1024 B,  errsize:       0 B,  current rate:     1024 B/s
     ipos:         0 B,   errors:       0,    average rate:     1024 B/s
     opos:         0 B,     time from last successful read:       0 s
  Finished