Is it possible to dd the current disk you are booted off?

You can run dd on the running disk. Doing so when there are heavy changes to the disk structure should be avoided. Also you should fschk the destination once you are done. The quieter the system is during the backup the better.

Running a cold backup (file system unmounted) is the best option if you want to use `dd'.

There are better options for backing up a running system.

• tar or cpio will read the files and deals reasonably well with open files. You will likely miss some of the changes which occur during the backup.
• rsync behaves like tar in respect to open files, and missing changes during the backup. It can be used to do the initial backup and does incremental backups very well. When running an incremental backup it can skip copying unchanged portions of file.

If you are backing up a file system with database datafiles investigate support for hot backups.

It is technically possible (as in "shooting-yourself-in-the-foot"), but highly unadvisable, especially if any of the disk's partitions are writable.

Picture this scenario:

• dd starts reading the disk at the start, and merrily makes its way towards the end.
• When it's halfway there, the OS writes a file to the disk. The file is somewhat fragmented though - one part of it is physically located towards the beginning of the disk, and another towards the end.
• No problem for the OS - it writes the file just fine, and pushes it out of its write caches; it is now correctly written on the disk.
• The problem is with your backup: dd has already gone past and copied the first part of the file, so it will capture an inconsistent state when it gets to the second part - each part will be from a different version!

If you're capable of remounting all the partitions on the USB disk as read-only, this problem shouldn't occur (emphasis on "should not"); this requires significant up-front install/offline preparation and boot-time setup for the / partition though - I don't think you can normally remount / r/o on-the-fly, there will be multiple things hanging off that requiring r/w access.

So, running the copy probably won't break the running system, but won't give you a workable backup, rendering the task moot. I highly recommend making the copy offline - which would require shutting down the machine.

You should never create an image of a mounted partition. No matter if you booted from it or not.

But you'll have a hard time trying to unmount the partition you booted from.