Linux dd 命令用于读取、转换并输出数据。

dd 可从标准输入或文件中读取数据，根据指定的格式来转换数据，再输出到文件、设备或标准输出。

参数说明(dd --help)Usage: dd [OPERAND]...

or: dd OPTION

Copy a file, converting and formatting according to the operands.

bs=BYTES read and write BYTES bytes at a time (also see ibs=,obs=)

cbs=BYTES convert BYTES bytes at a time

conv=CONVS convert the file as per the comma separated symbol list

count=N copy only N input blocks

ibs=BYTES read BYTES bytes at a time (default: 512)

if=FILE read from FILE instead of stdin

iflag=FLAGS read as per the comma separated symbol list

obs=BYTES write BYTES bytes at a time (default: 512)

of=FILE write to FILE instead of stdout

oflag=FLAGS write as per the comma separated symbol list

seek=BLOCKS skip BLOCKS obs-sized blocks at start of output

skip=BLOCKS skip BLOCKS ibs-sized blocks at start of input

status=WHICH WHICH info to suppress outputting to stderr;

'noxfer' suppresses transfer stats, 'none' suppresses all

BLOCKS and BYTES may be followed by the following multiplicative suffixes:

c =1, w =2, b =512, kB =1000, K =1024, MB =1000*1000, M =1024*1024, xM =M

GB =1000*1000*1000, G =1024*1024*1024, and so on for T, P, E, Z, Y.

Each CONV symbol may be:

ascii from EBCDIC to ASCII

ebcdic from ASCII to EBCDIC

ibm from ASCII to alternate EBCDIC

block pad newline-terminated records with spaces to cbs-size

unblock replace trailing spaces in cbs-size records with newline

lcase change upper case to lower case

nocreat do not create the output file

excl fail if the output file already exists

notrunc do not truncate the output file

ucase change lower case to upper case

sparse try to seek rather than write the output for NUL input blocks

swab swap every pair of input bytes

noerror continue after read errors

sync pad every input block with NULs to ibs-size; when used

with block or unblock, pad with spaces rather than NULs

fdatasync physically write output file data before finishing

fsync likewise, but also write metadata

Each FLAG symbol may be:

append append mode (makes sense only for output; conv=notrunc suggested)

direct use direct I/O for data

directory fail unless a directory

dsync use synchronized I/O for data

sync likewise, but also for metadata

fullblock accumulate full blocks of input (iflag only)

nonblock use non-blocking I/O

noatime do not update access time

noctty do not assign controlling terminal from file

nofollow do not follow symlinks

count_bytes treat 'count=N' as a byte count (iflag only)

Sending a USR1 signal to a running `dd' process makes it

print I/O statistics to standard error and then resume copying.

$ dd if=/dev/zero of=/dev/null& pid=$!

$ kill -USR1 $pid; sleep 1; kill $pid

18335302+0 records in

18335302+0 records out

9387674624 bytes (9.4 GB) copied, 34.6279 seconds, 271 MB/s

需重点查看参数：if, of, bs, skip, count

示例

源数据准备cat>dd_in.txt<

a

b

c

d

EOF

二分查看，前半部分数据dd bs=1 count=4 if=dd_in.txt

a

b

4+0 records in

4+0 records out

4 bytes (4 B) copied, 9.903e-05 s, 40.4 kB/s

二分匹配数据dd bs=1 count=4 if=dd_in.txt | grep b # 能匹配到

dd bs=1 count=4 if=dd_in.txt | grep c # 不能匹配到

二分查看，后半部分数据dd bs=1 skip=4 count=4 if=dd_in.txt

c

d

4+0 records in

4+0 records out

4 bytes (4 B) copied, 0.00013476 s, 29.7 kB/s

二分匹配数据dd bs=1 skip=4 count=4 if=dd_in.txt | grep b # 不能匹配到

dd bs=1 skip=4 count=4 if=dd_in.txt | grep c # 能匹配到

示例解释

dd bs=1 count=4 if=dd_in.txt

bs=1 设置每次查找块大小为1字节(这里数据小用1字节方便说明。在大文件的情况下，可以用 1024 这样 1KB 或更大的值加快扫描速度)

count=4 取4个块区，这个值需要配合文件大小计算出，前半部分。

以上就实现，文件二分查找前半部分，配合 grep 即可进行查找操作。

文件后半部分的查找需要配合 skip，跳过块区。