Procedures

Writing an image from the terminal on Linux and macOS

No tool to install, no interface between you and the device — which is exactly why the identification step deserves more care than the write itself.

By Thomas SonnabendUpdated August 20267 min readVendor-neutral

Key points

Identify the device by size and model, never by assuming the letter.
Write to the whole device, not to a partition on it.
The command returns before the data is on the drive — flush and confirm.

There is no undo. A raw write to the wrong device overwrites it without a prompt. Every step below exists to make sure the device you name is the device you meant.

Identify the device

Run this before plugging the stick in, then again after. The line that appeared is your device.

lsblk -o NAME,SIZE,MODEL,TRAN,MOUNTPOINT

You are looking for the row whose size matches the stick and whose transport is usb. Note the device name — sdb, not sdb1. The number is a partition; you want the device.

sudo dmesg | tail -n 20   # kernel messages from the moment it was plugged in

Unmount, do not eject

Desktop environments mount USB partitions automatically. Writing to a mounted device produces inconsistent results. Unmount every partition, but leave the device connected:

sudo umount /dev/sdX*   # unmounts sdX1, sdX2 ... if they are mounted

Write the image

sudo dd if=image.iso of=/dev/sdX bs=4M status=progress oflag=direct

Part	What it does
`if=`	Input file — the image you downloaded
`of=`	Output — the whole device, no partition number
`bs=4M`	Block size; larger blocks are considerably faster than the default
`status=progress`	Prints throughput instead of silence
`oflag=direct`	Bypasses the page cache so progress reflects reality

If dd makes you uneasy, this is equivalent on most images and harder to misuse:

sudo cp image.iso /dev/sdX && sync

Confirm it finished

The prompt returning does not mean the data has left the buffer. Flush explicitly, then compare what is on the device with the source:

sync

# read back exactly as many bytes as the image contains and hash them
SIZE=$(stat -c %s image.iso)
sudo head -c "$SIZE" /dev/sdX | sha256sum
sha256sum image.iso

Two identical hashes mean the write is byte-perfect. A mismatch means the stick, the cable or the port is at fault — not the image.

On macOS

diskutil list                       # find the disk number, e.g. disk4
diskutil unmountDisk /dev/disk4     # unmount, keep it attached
sudo dd if=image.iso of=/dev/rdisk4 bs=4m status=progress
sync
diskutil eject /dev/disk4

Use rdisk rather than disk — the raw device is dramatically faster. macOS will offer to initialise the drive when it reappears; decline that dialog, it does not understand the layout.

Safer alternatives

GNOME Disks — "Restore Disk Image" performs the same operation with the device list in front of you.
balenaEtcher — hides system drives and verifies after writing; published at etcher.balena.io.
An image loader — set up once, then plain file copies afterwards, with no raw writes at all.

A habit worth forming. Say the device name out loud before pressing Enter, and check it against the size column one more time. It costs two seconds and prevents the one mistake that cannot be taken back.