Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I just made a backup of an entire hard drive (50GB) over ssh via:

dd if=/dev/hda | buffer -s 64k -S 10m | ssh myuser@myhost "cat > ~/image.img"

What's now the best way to check the integrity of the file image.img, i.e. how to verify that everything is copied correctly?

share|improve this question
    
Usually when you dd, it is always perfect. However, you can always run sha1sum to check the sha1 hashes of the original and backup. –  darnir Aug 19 '12 at 7:06

2 Answers 2

up vote 2 down vote accepted

If the command terminated successfully, then the backup is correct, barring a hardware fault (which could equally affect any verification you might perform). It may later become incorrect if the hardware is faulty, but most storage hardware detects corruption.

Nonetheless, if you wish to check the backup, the best way is to take a cryptographic checksum on each side and compare them. For example:

ssh myuser@myhost "sha1sum image.img" &
sudo sha1sum /dev/hda

Check that the two checksums are identical.

Note that this tests whether the backup and the original are identical at the time of the check. Anything you change on /dev/hda, including mounting and unmounting a filesystem even without making any change (which will update a last mount date on many filesystems), will change the checksum. If you want to verify the integrity later, note down the checksum of the disk at the time of the backup somewhere.

share|improve this answer
2  
Note that if anything on /dev/hda has changed since the back up was made the hashes won't match. –  bahamat Aug 20 '12 at 4:39
    
The benefit of a hash check is that false-negatives (error made in recording image is, by chance, repeated during the hash run, so that a fault goes unnoticed) is astronomically miniscule. If any hardware fault is present, it should overwhelmingly result in a failed hash check. Will get a false-positive failed check if the disk has been changed, as has been noted. –  Steven Lu May 11 at 17:07
    
@StevenLu No, the chance of correlation is fairly high, because hardware faults aren't uniformly random. In particular, RAM errors (which are the most common hardware faults that are observable in typical PCs) occur at specific bits. –  Gilles May 11 at 18:14
    
Okay, probably... hash like this with a big grain of salt, sure, but OP was transferring over a network. It's just inherently unreliable, TCP notwithstanding. Besides, chances are probably that we will not be seeing the same exact access pattern (in physical memory). –  Steven Lu May 11 at 18:57

As darnir & Giles mentioned, the best thing to do is run cryptographic hashes immediately after the back up before anything has been altered on your source disk. If, however, you've used the disk since then the hashes will most likely not match. Even changing one byte on the disk will result in a completely different hash.

Although it's far less than ideal you can spot check the image by mounting it. On the system where the disk image is, run the following (create /mnt/disk if it doesn't exist or us an alternate location):

mount -o loop image.img /mnt/disk

You can then browse around in /mnt/disk and see all of the files. Check the sha1 hashes of critical files inside the image against the originals to verify their integrity.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.