Were the files on my "host" hdd modified in any way after running the dd command while (only) the destination hdd was mounted?

Question

PURPOSE: determine if the host hdd files should be completely intact, and thus, do not need to be re-copied.

In 1-2 of my other questions, I asked about what happens if one or both of the hdd's are mounted when using the 'dd' command (sudo dd if=/dev/sdx bs=16M of=/dev/sdy).

Previously, I used that command while my DESTINATION hdd was mounted, which was a mistake, clearly. However, the HOST hdd was NOT mounted.

I am going to do the duplicate (dd) over again, but I need to know if the HOST hdd is still 100% intact after running the dd command whereby the destination hdd was the only mounted hdd.

If the previously non-mounted HOST hdd could have gone changes while running the dd command, then I need to recreate the HOST hdd before copying it over to another hdd. Thus, I would have to go back to as many of the "original sources" as I have. But IF it's very likely that the host hdd has not been affected in any way, then I could still use that host hdd to make another backup.

Answer 1

dd if=/dev/sdx of=/dev/sdy reads from sdx and writes to sdy. Your sdx should have survived this and not changed its content, unless:

• sdx is faulty (like hardware failure) and the sole reading from it makes it more faulty;

• or some process wrote to sdx (not necessarily in a direct way).

  • The process could be the same dd that read sdx. Writing to sdy may mean writing to (a part of) sdx. Normally, if sdx and sdy are literally sda, sdb, etc. then it shouldn't happen. But e.g. you can read from a device (like sda) and write to a file in a mounted filesystem that exists somewhere on the same device. Or you read from a device and write to a RAID array that uses the very same device. In this case writing to the destination means writing to the source in an implicit way. In general it's best to know what exactly you're reading from and what you're writing to, and what the relation between the two is; they shouldn't "overlap" unless you really, really know what you're doing and you know this is what you want.
  • Or another process wrote to sdx in the same time. Note this also includes processes that know nothing about sdx but e.g. write to a mounted filesystem that exist somewhere on sdx (e.g. on sdx2 which denotes a part (partition) of sdx).

  If you want to make a good copy of a device then the device shouldn't be written to during the process at all. Keep in mind dd reads sequentially and any changes that happen when dd runs may affect the already read part and what is yet to be read. In effect the data structures (like filesystem(s)) in the copy may end up incoherent, even if they are coherent in the source at any given time. A graphical analogue is called "panorama fail": the reality (source) was coherent at any given time but photos (destination) look weird because they are composed from parts obtained before and after some change(s) took place.

  Usually an invalid copy occurs because of (some part of) the source being mounted, so the most common advice in the subject is to unmount the source device before you read it with dd.

---

If (some part of) the destination device (sdy in your example) is mounted, dd writes over a mounted filesystem. The copy it creates may get corrupted because the kernel may push writes to the filesystem in a belief it still exists on the device, while in fact dd managed to overwrite (a part of) it. These writes overwrite what dd wrote. The kernel may notice there's something wrong with the filesystem when it reads from it and gets data that doesn't fit. Even if the kernel refuses to work with the "disappearing" filesystem at some point, the copy may already be corrupted by former writes. Even if the kernel doesn't notice, the sole act of unmounting may write some data to the target device and corrupt what dd wrote.

But this only affects the copy. If this was the only problem then your source should be intact.

In my opinion the advice to unmount the target device is less commonly expressed because it's more intuitive, more obvious: you're going to overwrite something with totally different content, so you should stop anything that uses or relies on the old content. Many people tend not to state things they find obvious.