How to use the dd command in Linux?

dd’s conv=ucase example turns dd-lowercase.txt into LINUX DD TEST followed by a newline. What appeals to me is that dd changes the text during the copy.

Look at the two ends of dd’s copy. Identify the source with if= and the destination with of=.

What dd copies

GNU dd copies bytes from an input stream to an output stream, with optional conversions during the copy. The GNU Coreutils manual describes it as a file-copy and conversion utility.

The if= operand names the source, while of= names the destination. Without either operand, dd reads standard input or writes standard output. The paths decide direction.

1. if=FILE reads bytes from FILE instead of standard input.
2. of=FILE writes bytes to FILE instead of standard output.
3. bs=BYTES controls the block size, and count=N limits how many input blocks are copied.

Choose the input, output and block size

Check the source and destination paths before running dd because it does not ask whether the output is correct.

With bs=64K and count=1, dd reads one input block no larger than 64 KiB. For the whole file, omit count.

Copy and verify a regular file

Start with a source file you control and a new destination filename in a directory you can inspect.

I kept the copy test on regular files so its output could be compared without writing to a device.

1. Replace the example filenames with your input file and a new output file.
2. Run dd and check the reported byte count.
3. Compare the source and destination before using the copy.

dd if=copy-input.bin of=copy-output.bin bs=64K count=1 status=progress

The example source contains 65,536 bytes, so one 64 KiB block covers it. dd reported 65,536 bytes copied, with one full input record and one full output record.

I ran cmp before checking the hashes, so a byte mismatch would fail immediately. cmp returned success, and sha256sum printed the same digest for both files.

cmp -s copy-input.bin copy-output.bin && sha256sum copy-input.bin copy-output.bin

GNU dd truncates an existing regular-file destination before writing. The GNU conv=notrunc conversion suppresses that truncation, so choose a fresh output name unless you have a specific reason to preserve the old file length.

Create a sized file and convert text

A regular file can hold a fixed zero-filled length, while a conversion can transform bytes as dd copies text. I chose conv=sparse because its logical size and allocated space answer different questions.

Make a 1 GiB sparse file

/dev/zero supplies zero bytes, while bs=1M and count=1024 request 1,024 blocks of 1 MiB each. GNU conv=sparse represents all-zero output blocks as holes.

dd if=/dev/zero of=dd-1g-sparse.img bs=1M count=1024 conv=sparse status=progress

The command reported 1,073,741,824 bytes copied.

Check logical length and allocated space separately because a sparse file can occupy less space than its reported length.

stat -c '%s bytes' dd-1g-sparse.img && du -B1 dd-1g-sparse.img

stat shows the logical length, while du reports allocated space. This filesystem reports zero data bytes for the sparse output, but allocation varies by filesystem.

If you only need to create a regular file without filling it with data, use the steps for creating an ordinary file instead.

Convert lowercase text to uppercase

GNU conv=ucase converts lowercase text during the copy. The 14-byte fixture used here became LINUX DD TEST followed by a newline, and cmp matched it against the expected text.

dd if=dd-lowercase.txt of=dd-uppercase.txt conv=ucase
cat dd-uppercase.txt

The screenshot shows the same conversion on a short text file, but dd is not a general document converter.

Use cat and other file-reading commands to inspect your output.

gzip compresses a byte stream. tar stores paths and file contents in an archive, which gzip can compress afterward.

Identify a block device before writing

A whole-disk device and one of its partitions are separate output paths, so a partition listing cannot tell you which one to write. The device names below belong to example systems, not to your machine.

The NVMe rows below use names such as nvme0n1p1 and nvme0n1p3, while the whole-device name omits the partition suffix.

The crop shows partition rows from one example system, not a full device inventory or a write target. I kept both partition images as naming examples, not recommendations.

The /dev/sda1 and /dev/sda2 rows below identify partitions, not the whole disk.

Before writing a USB image, identify the whole drive and check whether its filesystems are mounted. The guide to disk partitioning tools explains the available views, while the USB mounting instructions help you check the mounted-filesystem state.

A write to the wrong of= path can replace data without an undo prompt. If your task is to erase and format a USB stick instead, follow the separate steps to format a USB drive.

Read progress and handle interruption

GNU dd accepts status=progress and prints transfer statistics while a copy runs. A short copy may finish before another update appears.

A progress report describes transferred bytes, not whether the source and destination are identical. Keep the source until cmp or a trusted checksum confirms the copy.

Confirm the destination on your machine

A sample path cannot tell you which device belongs in of= on another computer. Run this read-only inventory and match the disk by its size, model and mounted partitions before preparing a write.

lsblk -o NAME,SIZE,TYPE,MOUNTPOINTS,MODEL

If those fields do not identify the intended target, stop before running dd.

Frequently asked questions

After an interruption, a partial copy remains and dd saves no resume point. A mistaken device write has no undo.