[SOLVED] [dd] Skip sector with dd

[lladlu]

I'm playing around with a script to verify that no changes have been made to my MBR/boot-section.

I'm using dd to create files, and TrueCrypt to encrypt my entire system.
First I make a copy of my MBR+partition table with the command:

dd if=/dev/sda of=/tmp/mbr bs=512 count=1

Well, that was the easy part. I'm reading an article about the "Evil Maid" attack on system encryption, that tells me that the Truecrypt unencrypted boot-sector is located at the first 63 sectors of /dev/sda/.

Since I have just copied (and checked) the MBR, I'd want to exclude the first sector of 512 bytes from the next command.

dd if=dev/sda of=tmp/boot bs=512 count=62 skip=1

Will this command skip the first 512 bytes?

[Lostfarmer]

Linux Command Directory: dd

The answer is yes. 'bs=512' * 'skip=1' = 512 bytes or first sector.
You did leave off the '/' after if=/.

If 'bs=1024' with 'skip=1' then first 2 sectors would be skipped.

[lladlu]

Oh yeah, I did.

Thank you very much