dd Command Examples: 12 Real Uses

The dd command copies data from one place to another at the byte level, and the examples below show its most common real-world uses: making bootable USB drives, backing up disks, cloning partitions, and wiping data. You run dd in a Linux or macOS terminal with an input file (if), an output file (of), and optional settings like block size (bs) or progress reporting (status=progress).

What dd Actually Does

dd is a command-line utility present on virtually every Unix-like system, including Linux, macOS, and BSD. Its name comes from IBM’s Job Control Language where “DD” stood for “Data Definition.” Unlike normal file copy commands like cp, dd reads and writes raw data streams without interpreting the contents. That means it can copy a whole hard disk, including partition tables, boot sectors, and deleted files, because it never looks at what the bytes mean.

The basic syntax is:

dd if=/input/path of=/output/path [options]

Every dd command needs an input file (if) and an output file (of). In Unix, devices like /dev/sda (a whole disk) or /dev/sda1 (a partition) are treated as files, so you can point dd at them directly. That is what makes it so powerful and also so dangerous: one wrong character in the of path can overwrite your entire operating system.

Essential dd Options You Will Use

These options appear in almost every practical dd example:

if= — input file or device
of= — output file or device
bs= — block size, the number of bytes read/written at once (e.g., bs=4M for 4 mebibytes)
count= — how many blocks to copy; without it, dd runs until the input ends
status=progress — show a running transfer speed and byte count (Linux)
conv= — conversions like fsync (flush to disk before finishing) or noerror (keep going on read errors)
iflag=/oflag= — flags for input/output, e.g., oflag=sync for safe USB writing

Block size matters more than most people expect. A small bs like 512 bytes makes the copy many times slower because the system makes a syscall for every block. For disk images, bs=4M or bs=16M is a good balance between speed and memory use.

12 Practical dd Command Examples

Below are the most common dd commands you will actually type, with explanations of what each does.

Create a bootable USB drive from an ISO:
sudo dd if=ubuntu.iso of=/dev/sdb bs=4M status=progress oflag=sync
This writes the ISO image directly to the USB stick. Replace /dev/sdb with your USB device — check with lsblk first.
Back up a whole disk to an image file:
sudo dd if=/dev/sda of=/home/user/disk-backup.img bs=64M
Creates a byte-for-byte copy of the entire disk, including boot records and all partitions.
Clone one disk to another:
sudo dd if=/dev/sda of=/dev/sdb bs=64M
Copies everything from sda to sdb. The target disk must be the same size or larger.
Back up a single partition:
sudo dd if=/dev/sda1 of=partition1.img bs=4M
Only copies partition 1, not the whole disk.
Restore a disk image to a device:
sudo dd if=disk-backup.img of=/dev/sda bs=64M
The reverse of example 2. It overwrites the entire target device.
Wipe a disk with zeros (secure-ish erase):
sudo dd if=/dev/zero of=/dev/sdb bs=4M status=progress
Fills the disk with zeros. This makes old data unrecoverable by normal means.
Wipe a disk with random data:
sudo dd if=/dev/urandom of=/dev/sdb bs=4M status=progress
More thorough than zeros for data destruction, though still not a substitute for a certified erasure process.
Test read speed of a disk:
dd if=/dev/sda of=/dev/null bs=1M count=1024
Reads 1 GiB from the disk and discards it, timing how long it takes.
Test write speed of a disk:
dd if=/dev/zero of=testfile bs=1M count=1024 conv=fsync
Writes a 1 GiB file of zeros and flushes it to disk, then you can check the time.
Create a file of a specific size:
dd if=/dev/zero of=largefile bs=1M count=100
Makes a 100 MiB file full of zeros. Useful for testing or swap files.
Copy only the first 512 bytes (MBR):
sudo dd if=/dev/sda of=mbr.bin bs=512 count=1
Backs up the master boot record, which contains the boot loader and partition table.
Fix a corrupted USB drive by zeroing the first MB:
sudo dd if=/dev/zero of=/dev/sdb bs=1M count=1
Clears the partition table and boot sector, which often makes a drive usable again after a failed write.

Always check the device name twice before running any dd command that writes to a device. Use lsblk or diskutil list (macOS) to confirm you have the right one.

How to Choose the Right Block Size

Block size (bs) controls how many bytes dd reads or writes in one operation. The best value depends on what you are copying:

512 bytes — the traditional sector size; slow but works everywhere. Only use for special cases like backing up the MBR.
4M (4,194,304 bytes) — a good default for USB sticks and most disk images. Fast and safe.
64M or 128M — faster on modern hard drives and SSDs, but uses more RAM. If the system has little memory, stick to 4M.

There is no universal “best” block size. You can run a quick benchmark by copying from /dev/zero to /dev/null with different bs values and see which gives the highest throughput.

Common dd Mistakes and How to Avoid Them

The most frequent and dangerous mistake is getting if and of backwards. Writing to if= does nothing — but writing to of= with the wrong device destroys data instantly. Always double-check both paths before pressing Enter.

Another common issue is using count= without understanding block size. count=100 bs=1M copies 100 mebibytes, but count=100 bs=512 copies only 51,200 bytes. The total size is bs × count.

On macOS, status=progress is not available. Instead, you can send SIGINFO by pressing Ctrl+T while dd is running to see its progress. On Linux, Ctrl+T may not work; use status=progress.

When writing a bootable USB, some people forget oflag=sync. Without it, dd may return before the data is actually flushed to the stick, and unplugging it too early can corrupt the image. oflag=sync forces a flush before the command finishes.

dd vs. Other Copy Tools

dd is not the only way to copy data, but it is the most flexible at the raw level. Here is how it compares to common alternatives:

cp — copies files and directories, but cannot copy a whole disk or a bootable image. It reads and writes through the filesystem, so it cannot preserve the exact layout of a partition.
rsync — excellent for syncing directories over networks or locally, but it works at the file level, not the block level. You cannot use it to clone a disk.
cat — can redirect a device to a file (cat /dev/sda > backup.img), but it lacks dd‘s options for block size, count, and error handling.
GUI tools like Balena Etcher or GNOME Disks — easier for beginners and include safety checks, but they are less scriptable and often slower.

For cloning a disk while it is mounted, dd can produce inconsistent results because files are changing. Tools like partclone or Clonezilla are designed for that and handle the filesystem properly.

Safety Precautions and Data Loss Risks

Using dd is inherently risky because it does exactly what you tell it, with no confirmation. A single typo in of= can erase your home directory, your entire disk, or the system drive. Follow these rules:

Always run lsblk (Linux) or diskutil list (macOS) before writing to a device to confirm its name.
Unmount any partition you are about to overwrite. Writing to a mounted partition can cause corruption.
Use status=progress so you can see if the command is stuck or running normally.
Test a disk image by mounting it (read-only) before relying on it as a backup.
If you are not sure about a device name, stop and research. There is no undo for dd.

Also note that dd does not compress data. A full disk backup will be exactly the size of the disk, not the used space. For smaller backups, pipe through gzip: dd if=/dev/sda | gzip > backup.img.gz.

Frequently Asked Questions

Is dd safe to use?

dd is safe only if you type the correct device names and paths. It has no safety checks, so a mistake can destroy data instantly. Always verify the input and output with lsblk before running a write command.

Why is my dd command so slow?

The most common cause is a small block size. If you use bs=512, dd makes millions of tiny reads and writes. Increase bs to 4M or 64M for a dramatic speedup. Also, writing to a USB 2.0 port will be slower than USB 3.0, and some drives are just slow.

How do I see dd progress on macOS?

macOS does not support status=progress. Press Ctrl+T while dd is running to send SIGINFO, which prints the current transfer amount and speed. Alternatively, run dd in one terminal and use kill -INFO <pid> from another.

Can I use dd to create a bootable Windows USB?

dd can write a Windows ISO to a USB, but the result often does not boot because Windows ISOs use a different layout than Linux ISOs. Tools like Rufus or the Windows Media Creation Tool are designed for this and work reliably. dd is best for Linux and other Unix-like systems.

What is the difference between dd and dcfldd?

dcfldd is an enhanced version of dd created by the US Department of Defense Computer Forensics Lab. It adds features like hashing on-the-fly (MD5, SHA-1) and multiple outputs, which are useful for forensic imaging. For most users, standard dd is sufficient.

Does dd work on Windows?

Yes, but not natively. You can use dd through WSL (Windows Subsystem for Linux), Cygwin, or a standalone port. However, Windows device names are different (e.g., \\.\PhysicalDrive1), and writing to a disk requires administrator privileges. It is generally easier to use dedicated Windows tools for imaging.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →