Welcome to WebmasterWorld Guest from

Forum Moderators: bakedjake

Message Too Old, No Replies


Following a simple restore, there's nothing!

12:14 am on Dec 16, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Apr 20, 2004
votes: 0

I have a dd file generated from a 75GB hard drive that I am trying to restore to a 500GB blank USB HDD. I am forced to run Windows for this restore due to corporate security policies (if you can believe it), so I'm using 'dd for Windows' from chrysocome.net

I can mount the dd file in LiveView/VMWare with no problem ... full blown operating system (XP Pro) ... so the image is good. I've used dd successfully many times in the past with Linux systems, but this is the first time trying with the Windows version.

Here's what is happening: Running the 'dd' application to restore the contents of the file to the new drive produces ... nothing. Meaning:

dd if=discimg.dd of=\\.\k: bs=32768

dd = run 'dd' application
if = input file (discimg.dd)
of = output file (hard drive mounted as 'k')
bs = block size (64x512)

Drive 'k' is the Win32 exported USB drive I want to dump the image to. I have tried several things (as specified by 'dd --list'):

1) \\.\k:
2) \\?\Device\HarddiskVolume6
3) a Win32 native HDD (not USB)
4) no partition
5) partitioned but not mounted
6) partition formatted with NTFS but not mounted
7) partition formatted with NTFS and mounted

With each of the configurations above, the application runs, apparently successfully ... in that I receive a '2441406+1 records in \n 2441406+1 records out' notification at the end of the 1-hour process.

Unfortunately, at the end of the process, after viewing the 'records in/out' success notification ... the target drive remains completely empty. No partitioning, no formatting, no data ... no nothing. Just as I had it prior to the attempts.

I've used the unusual '--progress' dd option, and seen the bits being written (supposedly), but still no joy.

Does anyone have any thoughts on what might be happening? Is there a better way to restore a dd image to a USB HDD under Windows?

I really need to restore this image. Thanks in advance for any musings.

5:48 pm on Dec 16, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Apr 20, 2004
votes: 0

Quick (unsuccessful) update ...

The last attempt, with the partition formatted (NTFS) and mounted, rendered the filesystem unrecognizable. It's still showing as NTFS, but it's not being recognized as such.

I'm canning 'dd for Windows' and switching to the Forensic Acquisition Utilities set from gmgsystemsinc.com ... I'll let y'all know how it goes. Still very interested in any observations.

11:28 pm on Dec 16, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Apr 20, 2004
votes: 0

Thank goodness for a Knoppix disc!

So I figured, screw it ... if they don't see it, they won't know I used a Live CD, so I booted into Knoppix and ran dd (as root) from there without issue.

dd if=discimg.dd of=/dev/sdb bs=32768

Voila. Note that it is important that the target disc NOT be mounted, and target the disc root, not a partition (i.e. /dev/sdb instead of /dev/sdb1).


12:36 am on Dec 17, 2009 (gmt 0)

Junior Member

5+ Year Member

joined:Dec 23, 2008
votes: 0

Good on you, mate!
1:03 am on Dec 17, 2009 (gmt 0)

Senior Member from FR 

WebmasterWorld Senior Member leosghost is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Feb 15, 2004
votes: 230

the penguin can always see the windows ..but looking through the windows one cannot see the penguin :)

every time I plug an USB key from a linux machine ( like this one ..or my wife or sons web facing machines ) into any of the windoze machines we have ..the first thing that the redmond system says is .."the volume (x) appears defective , do you wish to repair the volume" ...
No I dont ..the volume is just fine thankyou ..click ignore and it all works ..but I do have to add a file type ( .exe or .avi or .txt etc ) to whatever is on the drive / volume before windoze can "see it" ..

funny it never has to be done the other way around :) ..I'm OS agnostic ..but I do wish that redmond would at least try to play nice with files made on linux ..always seems like they are cutting off their noses to spite our faces ..petty games ..

knoppix ..:) agreed ..Swiss army knife on a disc ..wouldn't be without it ..


Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members