5

I have a 660297728 byte HDD image with MD5 hash f5a9d398e974617108d26c1654fe7bcb:

root@T42# ls -l image
-rw-rw-r-- 1 noc noc 660297728 Sep 29 19:00 image
root@T42# md5sum image
f5a9d398e974617108d26c1654fe7bcb  image

Now if I dd this image file to /dev/sdb disk and check the MD5 hash of the disk, then it is different from MD5 hash of the image file:

root@T42# dd if=image of=/dev/sdb bs=512
1289644+0 records in
1289644+0 records out
660297728 bytes (660 MB) copied, 1006.38 s, 656 kB/s
root@T42# md5sum /dev/sdb
f6152942a228a21a48c731f143600999  /dev/sdb

What might cause such behavior?

landroni
  • 10,906
Martin
  • 7,516
  • 1
    what does cmp image /dev/sdb say? – Skaperen Sep 30 '15 at 11:56
  • cmp /dev/sdb image says cmp: EOF on image. – Martin Sep 30 '15 at 13:26
  • 3
    Your device sdb is larger than the image. dd if=/dev/sdb bs=512 count=1289644 | md5sum should return f5a9d398e974617108d26c1654fe7bcb - – Alex Stragies Sep 30 '15 at 13:55
  • @AlexStragies Do you know that /dev/sdb is larger than image because image reached end-of-file first? In addition, dd if=/dev/sdb bs=512 count=1289644 | md5sum and md5sum image indeed create a same hash. Does this mean that md5sum /dev/sdb reads in all the trailing zeros to first 660297728 bytes? I mean the /dev/sdb disk is 1024966656 bytes in size and if I dd the image onto /dev/sdb, then I write only first 660297728 bytes and rest of the 364668928 bytes are zeros(drive was zero-filled first). – Martin Sep 30 '15 at 15:21
  • 1
    @Martin. Yes, to all your questions: EOF on Image means "/dev/sdb has more stuff to compare, while image ran out of bytes". md5sum without options will always read the entire file/device/stdin given. Yes, dd without options wont invent random bytes to fill the rest of the device after image was completely written. Accept the answer from @frostschutz – Alex Stragies Sep 30 '15 at 17:18

2 Answers2

7

Is /dev/sdb exactly 660297728 bytes large? (blockdev --getsize64 /dev/sdb). If not, the checksum would naturally be different. Use cmp image /dev/sdb to find out where the differences are in detail. If it says EOF on image, it's identical.

frostschutz
  • 48,978
  • blockdev --getsize64 /dev/sdb shows the size of the whole block device(same as fdisk): 1024966656 bytes. image file is 660297728 bytes and as seen from output of dd, this is also the amount of bytes copied to /dev/sdb. – Martin Sep 30 '15 at 13:32
  • 3
    You can't expect same checksum for different size. – frostschutz Sep 30 '15 at 14:48
  • For some reason I thought that md5sum reads only the part I copied with dd if=image of=/dev/sdb bs=512. Looks like it count in the rest of the 364668928 bytes on the disk as well. – Martin Sep 30 '15 at 15:25
1

Maybe your disk on /dev/sdb has been modified by udisks or another process of your OS (automatically mounted for example).

Edit: Maybe the image is the image of a partition and not the whole hard disk.

You can compare yours disks with fdisk:

fidsk -l /dev/sdb

and

fdisk -l /path/to/image

See the numbers of blocks (and their sizes) maybe it will correspond to a only one partition.

Retry the md5sum on the concerned partition on /dev/sdb: md5sum /dev/sdbx (x is the number of the partition)

and compare with the md5 of your image

Edit 2:

Your source HDD does a size of 660297728 bytes (660 MB) so when you have done the dd, it was:

dd if=/dev/sda of=/path/to/image

So the image has the same size of the entire source hdd: 660297728 bytes

If you do a md5sum of the source HDD and image it must be the same.

When you copy the image to the new HDD, you do:

dd if=image of=/dev/sdb

But sdb has a size of 1 TB, so:

  • the first 660297728 bytes has been written by dd
  • the next 440 MB has not been written, the data are the same before dd maybe some zeroes or other.

If you do a md5sum on the entire sdb, you will include the 440 MB which has not been written and the result will not be the same of the md5sum of image.

If you want to do the md5sum of the new disk, you do:

dd if=/dev/sdb bs=512 count=1289644 | md5sum

The result must be the same.

Kusalananda
  • 333,661
Sorcha
  • 121