I'm trying to dump chunks of a disk drive into a file. When it works, the actual dumping is very quick. However, it takes literally hours to skip to the specified start of the chunk I want dumped. The command I would expect it to be is
dd if=/dev/hda1 bs=16065 skip=6532264 count=3000 | hexdump -C | tee /home/knoppix/dump (Though I suspect my understanding of the dd command is less than is necessary, because the skip option doesn't actually seem to be doing its job in my tests.)
I've actually had a success with hexdump, albeit a slow one, like so
hexdump -s 0xc7595100 -C -n 96000 /dev/hda1 | tee /home/knoppix/dump
I've found plenty of references to an iseek=stuff option to dd, which reportedly does a skip without looking through everything skipped, but my version of dd (coreutils 5.2.1) doesn't have it, (that's the one on the latest version of Helix), it's not in the man pages, and the newest version of dd I got off of the GNU website (5.94) doesn't have it, or any mention of it.
"iseek=n Seeks n blocks from beginning of input file before copying (appropriate for disk files, where skip can be incredibly slow." That sounds wonderful. I wish it existed.
This issue is really bugging me, and any help would be greatly appreciated. Thanks!
-Daniel
And ya know, I'd also really like to know why that dd command up there returns unexpected things or nothing, and what I would have to do to get it to do what I expect, as a sort of side note to my more important question. What would let me just dump a specified section of the hard drive (from this offset to this offset would be nice), quickly?. Thanks again,
-Daniel
After playing around some more, I still haven't solved the important problem, but I've discovered why I thought my dd command wasn't skipping to the requested offset. It turns out, it was, but it always started labeling its dumps at offset 00000000. (Hexdump did this.)
This won't be news to any of you, but it raises yet another question for me. I would really like to see these sixteen byte lines labeled with the correct offsets. (Correct being relative to the beginning of the drive.) How would I do this?
I'm so tired of hitting dead ends… I just need an easy, quick, hexdump -C sort of formatted, preferably Helix compatible, way of dumping a specified slice of a hard drive to a file. So sorry to keep posting variations of the same problem.
-Daniel
try to use hexdump with the -s option and pass it the skipped bytes. this should give you the wright reading.
Yes, it does. It just takes four hours. That's one of the working commands I put in my first post. Thanks anyway, though.
-Daniel