On Thu, Dec 11, 2003 at 02:54:12PM -0500, Dru wrote: > Can anyone describe or point me to resources explaining why it is > dangerous to dd a filesystem while it is mounted? Is it still considered > to be dangerous if the system is first dropped down to single-user mode?
I assume you're talking about dd of the filesystem block devices,
rather than anything else.
dd'ing from a mounted filesystem is generally safe, although you won't
get any sort of sensible result unless the source filesystem is
inactive -- remounting the FS read-only should be sufficient.
Using dd(1) to write to the block device of a mounted filesystem will
at minimum create a horrible mess and at worst could well crash the
machine.
Remember that dd(1) traverses the block device sequentially, but that
most FS accesses are random, so any particular change can span either
side of dd(1)'s offset. Also that dd'ing from the block device
bypasses the usual machinery for doing file IO -- machinery that is
designed under the premise that it will have sole control over what
gets read or written where and when.
dd'ing to a mounted filesystem will overwrite the original inode
structure, but the dd(1) process is going to be competing with the
buffer cache, which will tend to write data back using it's cached
version of the previous structure. You'll end up with a mess that
fsck(1) probably couldn't sort out. Even if the target FS is mounted
read-only the filesystem code will still probably throw a wobbly when
it finds the disk contents have been changed out from underneath it.
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
pgp00000.pgp
Description: PGP signature
