Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So what is the case when adding conv=sync,noerror makes a difference when backing up an entire hard disk onto an image file? Is conv=sync,noerror a requirement when doing forensic stuff? If so, why is it the case with reference to linux fedora?

Edit:

OK, so if I do dd without conv=sync,noerror, and dd encounters read error when reading the block (let's size 100M), does dd just skip 100M block and reads the next block without writing something (dd conv=sync,noerror writes zeros to 100M of output - so what about this case?)?

And if is hash of original hard disk and output file different if done without conv=sync,noerror? Or is this only when read error occurred?

share|improve this question
2  
dd has a manual page. –  grawity Jul 22 '13 at 3:15
    
Upvote for the question "Is conv=sync,noerror a requirement when doing forensic stuff? " –  nergeia Feb 20 at 10:00

1 Answer 1

conv=sync tells dd to pad each block to the left with nulls, so that if, due to error, the full block cannot be read, the full length of the original data is preserved, even though not all of the data itself can be included in the image. that way you at least know how damaged the data is, which might provide you with forensic clues, and if you can't take an image at all due to bad blocks or whatever, you can't analyze any of the data. some is better than none.

conv=sync,noerror is necessary to prevent dd from stopping on error and make a dump with same location for each blocks, than source. conv=sync is largely meaningless without noerror.

http://linuxcommand.org/man_pages/dd1.html

http://vlinux-freak.blogspot.com/2011/01/how-to-use-dd-command.html

share|improve this answer
    
Question: if one does dd without conv=sync,noerror does hash of hard disk and image file become different? –  dding Jul 22 '13 at 3:32
    
Also if dd encounters read error, does it stop at that moment then? –  dding Jul 22 '13 at 3:33
    
dd itself dossn't hash, so are you thinking about tools like dcflDD forensicswiki.org/wiki/Dcfldd ? in theory, the hash of the disk and the hash of the image should be the same, as long as the tools calculating the hashes encounter the errors in the same way. –  Frank Thomas Jul 22 '13 at 4:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.