How to use the dd command to clone corrupted disks in Linux

Why a corrupted disk challenges standard file copy tools

When a hard drive or memory card begins to fail physically, the file system—which is the organized structure used to store folders and files—usually collapses. Traditional copy tools, such as graphical file managers or the standard cp command, try to read data in a logical and organized manner. In practice, this means that upon encountering the first bad sector, which is the smallest physical storage unit on a disk, these tools freeze, generate read errors, and frequently abort the entire process. To prevent total data loss, system administrators rely on low-level utilities capable of interacting directly with hardware.

It is precisely in this critical scenario that the dd utility stands out in the Linux ecosystem. It is a classic command designed to convert and copy files from one location to another at the raw block level, completely bypassing file system logic. To better understand overall machine health and manage hardware resources during a crisis, it is useful to check tips on how to reduce CPU usage with htop on Linux. However, when dealing with a broken drive, dd must be configured with surgical care to avoid accelerating the medium's final failure.

Before triggering any rescue command, the fundamental step is to map out exactly which disk is faulty and which unit will serve as the copy destination. A typo in this step can overwrite the main operating system in seconds, wiping out irrecoverable data. To list the devices connected to the machine safely, the system's block listing utility is used, ensuring you identify the correct device file name, such as /dev/sdb for the damaged disk and /dev/sdc for the destination disk.

Preparing the ground and identifying units safely

To perform this initial check safely and accurately, follow the steps below in your terminal:

1. Open the terminal with administrative privileges to gain full access to hardware controllers.
2. Run the block listing command to view available partitions and sizes.
3. Enter the command

   lsblk -f

   to check active file systems and labels.
4. Carefully write down the paths for the source and destination devices on a physical notepad.

This preliminary check prevents unpleasant surprises and ensures the workflow follows a logical and predictable path. In complex infrastructure environments, diagnosing hardware and network faults with precision, such as how to monitor active TCP connections on Linux using the ss command, also helps isolate peripheral issues.

Mastering advanced parameters to bypass faulty blocks

The default behavior of the dd command is to halt operations immediately upon encountering an I/O error, which signifies any communication failure between the processor and the hard drive. When dealing with a corrupted drive, this behavior is the exact opposite of what we need. To force the utility to continue copying even when it encounters unreadable sectors, error-handling parameters are added to the command line configuration block.

In practice, we add specific arguments that instruct the utility to ignore read failures and fill corrupted spaces with zeros, maintaining the structural alignment of the generated image. This ensures that healthy data located before and after the damaged sector is successfully preserved. The advanced syntax combines conversion options that transform a fragile process into a robust forensic rescue routine.

Executing bit-by-bit cloning with dd

The practical execution of cloning requires an exact understanding of command syntax. The source block is defined by the if (input file) parameter, while the destination is set by the of (output file) parameter. To handle corrupted disks, we add the conv=noerror,sync directive, which tells the program not to stop on error and to synchronize missing blocks. Although classic dd resolves many situations, specialized tools like ddrescue are often even more efficient because they perform multiple intelligent passes over the media.

To perform a safe copy of a corrupted disk while bypassing damaged blocks, execute the procedures below:

1. Unmount all partitions on the damaged disk to prevent concurrent writes from corrupting further data.
2. Ensure the destination disk has equal or greater capacity than the source disk.
3. Run the resilient copy command with

   dd if=/dev/sdb of=/mnt/backup/rescued_disk.img bs=64K conv=noerror,sync status=progress

   in the terminal.
4. Wait for the process to finish without disconnecting cables or rebooting the machine to avoid breaking the buffer.

The status=progress parameter is a great ally because it displays in real time the amount of data copied, average speed, and elapsed time, easing operator anxiety during the rescue.

Validating recovered data and analyzing kernel logs

Once the cloning process finishes, the job is not yet done. It is essential to verify whether the image generated in the destination file is intact and if the saved data can be mounted or analyzed by file recovery software. The Linux Kernel stores a detailed history of all read attempts and hardware errors encountered during the process. Consulting these messages helps understand the severity of the physical damage on the disk.

To inspect hardware behavior and verify if the drive suffered catastrophic controller failures or scratched tracks, use system logs. Commands for auditing and deep inspection, such as how to audit Linux file permissions using the find command, also complement post-rescue verification by ensuring the image file has correct and secure access permissions on the server.

Final considerations on rescuing damaged media

Rescuing data from corrupted storage units requires patience, technical knowledge, and appropriate tools. The dd command, when combined with correct fault-tolerance parameters, turns into a true lifesaver for system administrators and tech enthusiasts. While no software works miracles on disks with severe mechanical damage to the magnetic surface or read head, mastering these techniques drastically maximizes the chances of recovering vital files before the drive stops working altogether.

Maintaining rigorous backup routines and proactively monitoring disk health through self-diagnostic tools remains the best strategy to prevent catastrophic information loss. With the knowledge acquired in this guide, you are prepared to face complex data corruption scenarios and execute bit-by-bit backups with total confidence and security in the Linux environment.