DEVICE SPECIAL FILES
Since any /dev entry can be treated as a raw disk image, it is worth not-
ing which devices can be accessed when and how. /dev/rdisk nodes are
character-special devices, but are "raw" in the BSD sense and force
block-aligned I/O. They are closer to the physical disk than the buffer
cache. /dev/disk nodes, on the other hand, are buffered block-special
devices and are used primarily by the kernel's filesystem code.
It is not possible to read from a /dev/disk node while a filesystem is
mounted from it, but anyone with read access to the appropriate
/dev/rdisk node can use hdiutil verbs such as fsid or pmap with it.
Beware that information read from a raw device while a filesystem is
mounted may not be consistent because the consistent data is stored in
memory or in the filesystem's journal.
The DiskImages framework will attempt to use authopen(1) to open any
device which it can't open (due to EACCES) for reading with open(2).
Depending on session characteristics, this behavior can cause apparent
hangs while trying to access /dev entries while logged in remotely (an
authorization panel is waiting on console).
Generally, the /dev/disk node is preferred for imaging devices (e.g.
convert or create -srcdevice operations), while /dev/rdisk is usable for
the quick pmap or fsid. In particular, converting the blocks of a
mounted journaled filesystem to a read-only image will prevent the volume
in the image from mounting (the journal will be permanently dirty).