sudo dd if=/dev/disk2 of=dump.img bs=1m
sudo dd if=/dev/rdisk2 of=disk.img bs=4m
Since any /dev entry can be treated as a raw disk image, it is worth noting which devices can be accessed when and how. /dev/rdisk nodes are charac-
ter-special devices, but are "raw" in the BSD sense and force block-aligned I/O. They are closer to the physical disk than the buffer cache.
/dev/disk nodes, on the other hand, are buffered block-special devices and are used primarily by the kernel's filesystem code.