On Fri, 27 Sep 2002 10:57:44 EDT, "Hooper, Justin" <Hooper_Jat_private> said: > real-world applications (block size for instance) and whether or not dd can > copy only files without slack or unallocated space. No. dd can't copy only files if you're using it to copy a disk partition, because it's copying the raw blocks and has *NO* idea what the data means - it could be a swap partition, or an ext2 filesystem, or an HFS+ filesystem, or ReiserFS, or NTFS, or... you get the idea. If you dd a 2G partition, it's 2G of disk blocks, and that's it. If you want to skip slack or unallocated space, you'll need to mount it as a filesystem and then use filesystem-level tools such as tar or cpio or backup (this of course means you only get the blocks that are in the filesystem - forensics work is usually interested in blocks that are no longer allocated....) -- Valdis Kletnieks Computer Systems Senior Engineer Virginia Tech
This archive was generated by hypermail 2b30 : Fri Sep 27 2002 - 10:58:09 PDT