Posted: Thu Aug 06, 2015 12:30 am Post subject: Re: blocksize
Hello, maybe its a newbi question but , it isn't clear to me why to use the blocksize option when doing an hdd imaging.
example: dcfldd if=/dev/sdb1 of=/home bs=512
Why use blocksize, any advantages ?
You're asking about a specific piece of software -- I can't answer that, except by assuming the documentation is correct.
However, in 'dd', bs is used to determine just how large blocks are read/written. However, this is how dd splits the job up -- the operating system may be more intelligent and request a longer sequence of sectors from the disk in one single read.
With modern 4k-sector drives, for example, reading/writing in 512-byte chunks probably isn't the fastest option. The software will probably read 4k, and then have to split it up into bs-sized chunks. Which may be a waste of time.
And reading bs=715 sized blocks from a 512-byte sector size disk is probably going to cause various alignment problems, and lots of buffer management.
In the presence of errors, however, the bs-size may affect the result, say, like zeroing out all data read in that particular block (or just dropping all data from the point the read error ocurred.) In such situations, you may lose information due to too large block size.
In the very particular situation you ask about, i.e.
dcfldd if=/dev/sdb1 of=/home bs=512
I see no use for it, and I would not include it myself. (Unless you're doing some kind of benchmark, or the default value is something weird. I think bs=512 is default, though.)
However, if you had included the command line option 'conv' and it's suboptions 'sync' and/or 'notrunc', it would have been another situation. In those cases, bs (or ibs/obs) are important to know.
But for an explanation of those, I'm going to refer you to the man page for dcfldd.
Then you also see that I have simplified my answer a little, as the number of blocks read in one go is decided by the count= option, which I think defaults to 20.
Posted: Sat Aug 15, 2015 4:03 am Post subject: Block size
The syntax of this command is very similar to DD, which we use very often in the computer forensic lab at work. The advantage of using the blocksize is moving data from one piece of media to another. While both may happen to have the same Sector size or I/O size you often run into situations where they differ. The TL;DR of it is using a smaller blocksize of 512 is that the data will copy easier in smaller chunks from differentiating blocksize media as they both will support the smaller chunks.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum