dumping a raid member with 'dd' for insurance...

[George Sanders]

A 3ware raid5 array I had died.

It looks like the data is intact, and there are two good recovery methods:

1) a toolchain from 3ware that, if it doesn't work, will destroy the data.  This method is free, and I can do it myself.

2) professional forensic services.  Costs a lot.

I'm going to start with #1, but before I do I want to image the individual drive members so that I can go to method #2 if necessary.

I am planning on attaching each individual member of the raid5 array to a test FreeBSD system, and run:

dd if=/dev/ad1 of=/data/disk/image.file

Two questions:

- is that a complete 'dd' command, or do I need to specify "bs=xxx" and "count=xxx"  ?

- is there any chance that simply booting with this drive attached to the system, and running a 'dd' like this, will somehow alter the contents or "touch" the array member in any way ?  What I have described above appears to be a completely read-only process, but I'd like to make sure there aren't ANY bits that FreeBSD will write to this disk ...

Thak you.