A friend is trying to clone a CF card using the following linux command:

sudo dd if=/dev/sdb of=card3.img bs=4M status=progress

but each time, it is producing a different image. The first two cards they have imaged have produced inconsistent results. What could be the cause of this?

  • 2
    Is the card currently mounted, maybe things are changing on it – Xen2050 Dec 7 at 9:28
  • @Xen2050 He has been unmounting it before each dump. But just mounting a device shouldn't write to it, should it? – Hiccup Dec 7 at 9:37
  • Mounting itself shouldn't modify device's content, but it enables processes to do so. And there's plenty of stuff running in the background in modern OSes. – gronostaj Dec 7 at 9:47
  • Indeed, but I think it would be considered a bug if an OS wrote to external storage without the users permission. – Hiccup Dec 7 at 9:50
  • 2
    Mounting may modify the device's content: it may update the last-mount timestamp on some filesystems, or the root directory's last-access timestamp, or even the journal in some cases. – grawity Dec 7 at 9:51

Just mounting with write access (rw) could be writing things, on ext filesystems there's at least the following attributes that are updated:

  • Last mounted on
  • Mount count
  • Last mount time
  • And possible files access times that are updated when if files are just read (mount's noatime should stop those).
  • And a "Last write time" attribute if writing occurs)

Actually, mounting without write access (using mount's -r / -o ro) might still write to the device, see man mount:

-r, --read-only

Mount the filesystem read-only. A synonym is -o ro.

Note that, depending on the filesystem type, state and kernel behavior, the system may still write to the device. For example, ext3 and ext4 will replay the journal if the filesystem is dirty. To prevent this kind of write access, you may want to mount an ext3 or ext4 filesystem with the ro,noload mount options or set the block device itself to read-only mode, see the blockdev(8) command.

And blockdev has the --setro command, to set a block device as read-only

You could compare the images and see which bytes are different, with cmp or something like vbindiff. Only a few bytes could be a date or count somewhere (I'm not sure if the attributes are stored as plain text, or encoded somehow).

Or read-only mount two (or more) of the images and compare just the files. Plain diff can compare directory trees, but I prefer a gui like kdiff3. If the only difference is in the mount count or last mount time it won't show up in the files (different file access times probably won't either).

Or maybe the device or your ram or something else is going bad & reading different bytes here & there.

You could also keep the device unmounted, make an image, then unplug & reconnect the device (still unmounted) and make another image & then compare, they should be the same.

  • @KamilMaciorowski How would you "deny write access to it before mounting? – Hiccup Dec 7 at 19:36
  • @KamilMaciorowski Very interesting, I didn't know chmod was all that's needed to ro a device, didn't even know it was possible actually. Have any links to more info? I tried searching & found an inconclusive Q on U&L, and blockdev --setro & mount's noload, but mostly drowned in hits for mount ro & "my USB went ro". – Xen2050 Dec 8 at 13:10
  • @Xen2050 I was wrong, my tests were not good enough. Now I see chmod doesn't prevent access in general. I guess this is the reason. I will delete my comments in few hours. – Kamil Maciorowski Dec 8 at 18:48
  • @Hiccup See my comment just above. Now I think I mislead you with chmod. I'm sorry and I apologize. – Kamil Maciorowski Dec 8 at 18:50
  • @KamilMaciorowski Ah well, it did seem almost "too good to be true," at least I learned a little more about mount's sneaky writes & noload & blockdev – Xen2050 Dec 10 at 3:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.