2.5.2. Disk Duplication and Remote Sync

💡 First Principle: dd (data duplicator) operates at the block level — it copies bytes directly, bypassing filesystem awareness. This makes it the right tool for creating exact disk images, zeroing disks before disposal, and writing bootable media. It also makes it dangerous: dd does exactly what you tell it, including overwriting the wrong disk.

# Disk imaging
dd if=/dev/sda of=/backup/disk.img bs=4M status=progress    # Image entire disk
dd if=/backup/disk.img of=/dev/sdb bs=4M status=progress    # Restore image

# Write bootable USB
dd if=linux.iso of=/dev/sdb bs=4M conv=fsync status=progress

# Secure disk zeroing (before decommission)
dd if=/dev/urandom of=/dev/sdb bs=4M status=progress        # Write random data
dd if=/dev/zero of=/dev/sdb bs=4M status=progress           # Write zeros

# Create a file of exact size (e.g., for a swap file or test)
dd if=/dev/zero of=/swapfile bs=1M count=2048               # 2 GB swap file

ddrescue: For recovering data from failing disks — unlike dd, it handles read errors gracefully, logs progress, and allows retries:

ddrescue /dev/sda /backup/rescued.img /backup/recovery.log

rsync — Efficient File Synchronization:

rsync only transfers changed blocks, making it far faster than cp for large directory trees. It understands permissions, timestamps, and can work over SSH:

# Local sync
rsync -av /source/ /destination/          # Sync with archive mode and verbose

# Remote sync over SSH
rsync -avz /local/data/ user@server:/remote/path/   # Compress in transit
rsync -avz --delete /source/ user@server:/dest/     # Mirror (delete extras on dest)

# Key flags: -a=archive(preserves perms,times,symlinks,owner,group)
#             -v=verbose  -z=compress  -n=dry-run  --delete=mirror mode
#             --exclude=  --bwlimit=1000 (KB/s bandwidth limit)

⚠️ Exam Trap: The trailing slash in rsync is significant. rsync -av /source/ /dest/ syncs the contents of /source into /dest. rsync -av /source /dest/ syncs the directory itself (creating /dest/source/). One missing slash creates an entirely different directory structure.

Reflection Question: You use rsync --delete to mirror /data/ to a backup server nightly. A team member accidentally deletes 500 files from /data/ at 2 PM, and the backup job runs at 3 PM. What happens to those files on the backup server, and what does this teach you about rsync as a sole backup strategy?