Fog Creek Software
Discussion Board

"DD"-like util for Windows??

Hi all!!

Just a quick question: I'm looking for a tool (freeware, if possible ;) that gives me the same functionality on Windows that dd does on linux...

Specifically, I want to be able to read the first sectors (partition table, MBR, etc) off a Hard Disk and save them to a file (or read them from a file and write them to the disk).

Under linux, I could do something like:

dd if=/dev/hda of=bootsect.file bs=512 count=1

I have a port of dd for windows from the GNUtils ( ), but  I don't know how to point it to the "raw" physical disk (or to any specific device, for that matter)...

I'm pretty sure that there has to be a way to do that.... Mainly, I'm interested in a way to save the MBR of the HDD to/from a file, but  the sort of control dd gives would be nice to have.

Thanks a lot

Javier Jarava
Monday, May 19, 2003

The "dd" from UnxUtils works fine under Windows 2000/XP.  It's just the syntax that is different.  For example, I use the following command to create an ISO from a CD-ROM:

    dd if=\\.\r: of=x.iso


Ryan Mitchell
Monday, May 19, 2003


Thanks for the dd if=\\.\letter: tip

The thing I don't (quite) get is, what am I accessing to?

I mean, I have 4 partitions on my "HDA" disk (IDE 0:0), with letters C:, E. and H:
I have ~8 Gigs unpartitioned space _before_ my c: partition (for a soon-to-come Linux install, hopefully ;)

Gdisk32 says about my "1" drive:

K:\temp>gdisk32 1  /lba
Disk  Partitions  Cylinders  Heads  Sectors  Mbytes  Sectors
  1        4        9726    255      63  76293.9  156250000

ID Parent Slot Sys  Type        Starts      Ends    Offset  Sectors
00  --    0  07  PRIMARY    16386363  47118644  16386363  30732282
01  --    1  07  PRIMARY    47118645  88084394  47118645  40965750
02  --    2  0F  EXTENDED  88084395 156232124  88084395  68147730
03  02    0  07  LOGICAL    88084458 156232124        63  68147667

so, if I understand properly, when I do:

K:\temp>dd if=\\.\c: of=bootsect.dat bs=512 count=1
1+0 records in
1+0 records out

I am copying the first 512 bytes... of the "c:" partition?? Or is it from the underlying physical drive?

(it must be, becuse running similar commands for the E: and H: partitions gives me different output files, so the "origin" must be different)

so, what is the "device name" to use to access the "drive"?

Thanks a lot

Javier Jarava
Monday, May 19, 2003

Seems to me it's HardDisk0, HardDisk1, etc., but I'm not sure if that's exactly right.

Brad Wilson (
Monday, May 19, 2003

Apparently you can use the syntax \\.\PhysicalDrive0\Partition0.  This is a result of some Google searching and I have no experience with it myself, so don't blame me if things go bad...

Lots of neat Windows dd tricks about halfway down this page:  Looks like you can also dump physical memory, which is kind of cool.

Do a Google search on "PhysicalDrive0" for other reference pages.


Ryan Mitchell
Monday, May 19, 2003

Thanks to everybody for the input...

The \\.\PhysicalDrive0 syntax looks like it did the trick ;)

At least, the command:
dd if=\\.\PhysicalDrive0 of=bootsec.dat bs=512 count=1
gives me a file that (at fist look; have to look into it carefully :) seems to be what I needed

Thanks all for the help & tips (BTW, very interesting page on forensics ;)

Javier Jarava
Thursday, May 22, 2003

*  Recent Topics

*  Fog Creek Home