Dd (Unix)

dd is a common Unix program whose primary purpose is the low-level copying of files. It has a different set of command line options than the ordinary cp command (which copies files in their entirety) that allow copying a fixed number of bytes or blocks, performing on-the-fly byte order conversions, as well as more esoteric EBCDIC to ASCII conversions. Nowadays dd is mostly used to copy regions of raw device files, e.g. backing up the boot sector of a hard disk, or to read fixed amounts of data from special files like /dev/zero or /dev/random. Because dd can copy entire partitions or disks (this is more due to Unix providing access to these devices than the functionality of dd per se), it is used in computer forensics when the contents of a partition need to be preserved in a byte-exact copy. Using cp would not be enough, since data from deleted files that may still be present on a disk are not visible through the file system interface.

The command line syntax of dd is unlike that of any other Unix program, resulting in widespread fear and loathing. The fear is due to the fact that dd is used for low-level operations on hard disks: one tiny mistake, and instead of restoring a boot sector one may have rendered an entire disk virtually unusable. The loathing is triggered by the blatant violation of the Unix philosophy of using a common syntax for all command line tools.