3

I have a .RAW image. The image contains a single partition.

I have created a loopback based device. I created a single partition on that device.

I'm writing my .RAW to the partition.

sudo dd if=/tmp/image.raw of=/dev/loop25p1 status=progress

I then read the partition

 sudo dd of=/tmp/image.dd.raw if=/dev/loop25p1 status=progress

I then take the sha1sum of the original and recreated file.

sha1sum /tmp/image.dd.raw 
0d31163796cda45e016f5f1459426adb4a872b57  /tmp/image.dd.raw

sha1sum /tmp/image.raw 
d961e97b63472cd3f317f8823de68508e583f713  /tmp/image.raw

Why do these differ?

2
  • What is the output of </tmp/image.dd.raw wc -c? What is the output of </tmp/image.raw wc -c? Feb 20 at 19:01
  • (1) Is it possible the filesystem (if any) you have written to /dev/loop25p1 got mounted automatically? (2) Is it possible something else wrote to /dev/loop25p1 after the first dd started and before the second dd finished? (3) Is it possible something wrote to /dev/loop25 at that time? (4) Is it possible at that time something wrote to the regular file associated with the loop device? Feb 21 at 5:21

1 Answer 1

3

Hypothesis: /tmp/image.raw is smaller than /dev/loop25p1.

/dev/loop25p1 is a block device with a certain size. It had its size even before you wrote anything to it. Copying a smaller file to a block device does not and cannot truncate it.

My guess is /tmp/image.raw is smaller than /dev/loop25p1. After copying the former to the latter, the latter contains the data from the former plus whatever was already there beyond the size of the former. In other words your first dd did not overwrite the whole /dev/loop25p1 because it reached the end of its input before it reached the end of its output.

When you copied /dev/loop25p1 to /tmp/image.dd.raw, you got all the data from the block device, including the part the first dd never got to. The images are different because of this "tail" in /tmp/image.dd.raw.

If you do

cmp /tmp/image.raw /tmp/image.dd.raw

you will get

cmp: EOF on /tmp/image.raw after byte …

which means that up to the end of /tmp/image.raw the files are identical, but the other file contains more bytes.

2
  • Good point. I hadn't considered that. I've never used that tool before. In my case it gave "differ: byte 1, line 1" Im surprised this happens so early I would have presumed it happened at the tail..
    – bearrito
    Feb 20 at 20:38
  • 1
    @bearrito This means my hypothesis is false, it does not match your case. I still think it's a plausible hypothesis in general. Feb 20 at 20:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .