On Thu, Dec 11, 2003 at 02:54:12PM -0500, Dru wrote: > Can anyone describe or point me to resources explaining why it is > dangerous to dd a filesystem while it is mounted? Is it still considered > to be dangerous if the system is first dropped down to single-user mode?
I assume you're talking about dd of the filesystem block devices, rather than anything else. dd'ing from a mounted filesystem is generally safe, although you won't get any sort of sensible result unless the source filesystem is inactive -- remounting the FS read-only should be sufficient. Using dd(1) to write to the block device of a mounted filesystem will at minimum create a horrible mess and at worst could well crash the machine. Remember that dd(1) traverses the block device sequentially, but that most FS accesses are random, so any particular change can span either side of dd(1)'s offset. Also that dd'ing from the block device bypasses the usual machinery for doing file IO -- machinery that is designed under the premise that it will have sole control over what gets read or written where and when. dd'ing to a mounted filesystem will overwrite the original inode structure, but the dd(1) process is going to be competing with the buffer cache, which will tend to write data back using it's cached version of the previous structure. You'll end up with a mess that fsck(1) probably couldn't sort out. Even if the target FS is mounted read-only the filesystem code will still probably throw a wobbly when it finds the disk contents have been changed out from underneath it. Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK
Description: PGP signature