3.1 Ghost a hard disk drive

Assuming that /dev/sda is the primary hard disk drive to back up, and /media/backup is mounted to a back up storage file system (which can be an external hard disk drive, network storage or other forms of storage), the command to “ghost” the drive is as follows:

dd bs=512 if=/dev/sda of=/media/backup/myBackup.img  
    

The bs=512 option states that read/write operations must use 512-byte blocks, which is the default sector size of a hard disk drive. if=/dev/sda specifies the “input file” to copy from, and of=/media/backup/myBackup.img specifies the “output file” to copy to.

If we need to restore the content of the hard disk drive (assuming the drive to restore to is at least as big as the original), we can use the following command:

dd bs=512 if=/media/backup/myBackup.img of=/dev/sda