[gentoo-user] Re: Fast checksumming of whole partitions

[7v5w7go9ub0o <7v5w7go9ub0o@gmail.com>]

On 06/06/10 16:45, Andrea Conti wrote:
>>> 1- if the root partition is [part of] what you're copying, you
>>> *must* mount it read-only (mount -o ro /dev/sdc /work)
>>
>> Not from my experience; I simply mount, exec, and go - Works fine
>
> Let's say you are 50% done copying a partition, when something
> writes to it. If the write only affects the first half, which has
> alredy been copied, the target will consistently reflect the "old"
> state; if on the other hand the write only affects the second half,
> which has not been copied yet, the target will consistently reflect
> the "new" state. The problem is that with any write affecting both
> halves your copy will contain a mix of the two states and thus will
> be inconsistent.

Should that happen, I certainly agree that the copies would be
inconsistent... but I don't know what would cause the live OS to write
anything to it (other than update the last access date/time - which
occurs early on).

At any rate, should that happen, the hashes would disagree and I'd
reject the copy. Thus far the whole-disk hashes have always agreed

Now, if this were a forensic investigation, then you're absolutely right
- even updating an access time would be unacceptable; regardless that
the changed source and copied destination hash the same.