How to Write an OS ISO to USB and Verify It (Windows, Mac, Linux)

To put an operating system ISO on a USB stick safely, download it only from the vendor (microsoft.com, ubuntu.com, fedoraproject.org, debian.org), verify its checksum and the signature on that checksum, then write it with the vendor's recommended tool. On Windows, use Microsoft's Media Creation Tool for Windows 11, and Rufus, balenaEtcher or Fedora Media Writer for Linux images as each distro's docs advise. On macOS and Linux, use the distro's writer or dd only after you have positively identified the stick.

Apple is the exception: it does not ship macOS as an ISO. You build a macOS installer stick with Apple's createinstallmedia command instead. Everything below follows the vendors' own documentation, fetched on 23 October 2026, with the source linked beside each command.

Key takeaways

• An ISO is a byte for byte disc image. Most Linux ISOs are "isohybrid", so the same file boots from DVD or from a USB stick written directly from it. Copying the ISO onto a stick as a file does not make it bootable.
• Download only from the vendor. Microsoft, Canonical, Fedora and Debian publish images and checksums on their own domains. Apple ships macOS installers through the App Store and softwareupdate.
• Check the checksum and the signature on it. Ubuntu signs SHA256SUMS, Fedora signs its CHECKSUM files, Debian signs SHA512SUMS. Microsoft lists SHA256 values for each Windows 11 ISO.
• dd overwrites whatever disk you name. List disks before and after plugging in the stick, match size and model, unmount, then write.
• Prefer the vendor's writer. Fedora Media Writer and KDE ISO Image Writer verify images; the Media Creation Tool downloads and writes in one step.
• Old boot media can stop working after Microsoft's Secure Boot revocations are applied, so rebuild it.

What is an ISO file?

An ISO file (named after the ISO 9660 CD file system) is a single file that holds an exact copy of the data on an optical disc. Debian's CD FAQ describes a CD image as "the exact representation of the data on a CD in a normal computer file". The name stuck long after the images outgrew CDs; Debian builds images sized for DVD and Blu-ray as well as small netinst images.

Three things follow from that definition:

1. You cannot just copy the ISO onto a USB stick. Ubuntu's documentation says making installation media "is different from copying a file to the USB stick". The stick has to be rewritten with the image's own partition layout and boot loader, which is what image writers do.
2. Most Linux ISOs are already USB ready. Debian's installation guide explains that its amd64 images use isohybrid technology, so they can be written straight to a USB stick. Rufus will tell you the same thing about Ubuntu images ("an ISOHybrid image"), according to Ubuntu's Rufus walkthrough.
3. The image must go to the whole disk, not a partition. Debian's guide is explicit: write to /dev/sdb, not /dev/sdb1.

Windows is different: Microsoft's Media Creation Tool prepares the stick for you, and the Windows 11 ISO is a multi-edition image unlocked by your product key.

Where do you get official OS images?

Get every image from the operating system's own site. Search ads and "free download" portals add a middleman you have no reason to trust, and none of the vendors below ask you to use one.

A few points from the vendor pages are worth knowing before you click anything:

• Windows 11 media is x64 only through these tools. Microsoft's page says the Installation Assistant does not run on Arm based PCs and the Media Creation Tool only creates media for x64 processors. Arm64 ISOs are linked separately from the same page.
• Windows 10 media still exists, but the OS is out of free support. The Windows 10 download page states that after 14 October 2025, Windows 10 no longer receives free software updates, technical support or security fixes. A new Windows 10 install starts life without free security fixes.
• Ubuntu and Debian images are mirrored widely. Ubuntu's tutorial says you can fetch SHA256SUMS and SHA256SUMS.gpg from releases.ubuntu.com even if the ISO came from a mirror. Get checksum files from the project's own site.

How do you spot a lookalike download site?

You need a habit more than a tool. Type the vendor's domain yourself or use a bookmark, and check the address bar shows exactly microsoft.com, ubuntu.com, fedoraproject.org, debian.org or apple.com, not a near miss. Distrust any page that wraps the ISO in its own "downloader". Then let verification be the real test: a lookalike site can copy a page, but not a valid vendor signature on a modified checksum file.

How do you verify an ISO before writing it?

Verification answers two questions. Was the file damaged or changed in transit (integrity)? Did it come from the vendor (authenticity)? A checksum answers the first. A signature over the checksum list answers the second. For a longer explanation of the difference, see checksum vs signature: which to trust for a download.

Verify a Windows 11 ISO

Microsoft's Windows 11 download page has a "Verify your download" section. Open PowerShell and run Get-FileHash against the ISO, then compare the SHA256 output with the value Microsoft lists for your language and edition.

# Microsoft's example form; replace the path with your downloaded ISO
Get-FileHash C:\Users\user1\Downloads\Contoso8_1_ENT.iso

Get-FileHash uses SHA256 by default, according to Microsoft Learn. If the output matches, Microsoft says the file has not been corrupted, tampered with or altered. If you used the Media Creation Tool to write a stick directly, there is no ISO to hash; the tool downloads and writes in one step.

Verify an Ubuntu ISO

Canonical's verification tutorial uses gpg and sha256sum. Put the ISO, SHA256SUMS and SHA256SUMS.gpg in the same folder and work from there.

# 1. Check the signature on the checksum file
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

# If gpg says "Can't check signature: No public key", fetch the keys the tutorial lists
gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x46181433FBB75451 0xD94AA3F0EFE21092

# Show their fingerprints and compare them with the ones in Ubuntu's tutorial
gpg --keyid-format long --list-keys --with-fingerprint 0x46181433FBB75451 0xD94AA3F0EFE21092

# Run the signature check again; you want "Good signature"
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

# 2. Check the ISO against the verified checksum list
sha256sum -c SHA256SUMS 2>&1 | grep OK

The output you want ends in your ISO's file name followed by OK. If you get nothing, Ubuntu's tutorial says the ISO does not match, whether through tampering or a bad download, and you should get a fresh copy from a known good source.

gpg will warn that the key "is not certified with a trusted signature". Ubuntu explains this only means you have not countersigned the key; "Good signature" is what matters, provided the fingerprint matches Ubuntu's. The tutorial's example output is from older releases, so if gpg names a different key ID for your release, fetch that key the same way and check its fingerprint before trusting it.

On macOS, Ubuntu suggests installing GnuPG and coreutils with Homebrew; macOS also ships shasum, whose manual page documents -a 256 and -c. On Windows, Ubuntu suggests running the same commands in WSL.

Verify a Fedora ISO

Fedora's security page gives the full procedure. Download the ISO and its matching CHECKSUM file into one folder, then:

# 1. Download Fedora's OpenPGP certificates
curl -O https://fedoraproject.org/fedora.pgp
curl -O https://fedoraproject.org/fedora.gpg

# 2. Show the certificate details and compare the fingerprints
#    with the ones listed on fedoraproject.org/security
sq keyring list fedora.pgp
gpg --with-fingerprint --show-keys --keyid-format long fedora.gpg

# 3. Verify the signed CHECKSUM file and check the image (gpgv version)
for file in *-CHECKSUM; do
   gpgv --keyring ./fedora.gpg --output - \
     "$file" \
     | sha256sum -c --ignore-missing
 done

Fedora also gives an sq verify version of step 3 for Sequoia users. The ignore missing option, documented in the sha256sum manual page, skips list entries for images you did not download. Fedora's page lists one signing key per release (Fedora 43, 44, 45 and Rawhide at the time of writing), each with a fingerprint, so you can match the key to your release.

If you use Fedora Media Writer, much of this is automated. Fedora's live image documentation says the tool verifies the download automatically and checks the image again once it has been written to the stick.

Verify a Debian ISO

Debian's verification page says official images come with signed checksum files in the same iso-cd, iso-hybrid and similar directories as the images. It recommends SHA256 or SHA512 with sha256sum or sha512sum, and any OpenPGP implementation (it names GnuPG, Sequoia-PGP, PGPainless and GopenPGP) to check the .sign files. The page lists the fingerprints of the keys Debian has used in recent years and links to each public key.

Debian's page describes the steps without printing commands, so the commands below use the GnuPG import and verify operations and coreutils check mode with Debian's file names:

# 1. With the ISO, SHA512SUMS and SHA512SUMS.sign in one folder,
#    check the signature; gpg reports the key ID it needs
gpg --keyid-format long --verify SHA512SUMS.sign SHA512SUMS

# 2. Download that key from the link on debian.org/CD/verify, for example:
curl -O https://www.debian.org/CD/key-DA87E80D6294BE9B.txt
gpg --import key-DA87E80D6294BE9B.txt

# 3. Compare the fingerprint gpg prints with the one on Debian's page,
#    then verify again; you want "Good signature"
gpg --keyid-format long --verify SHA512SUMS.sign SHA512SUMS

# 4. Check your image against the verified list
sha512sum -c --ignore-missing SHA512SUMS

Debian adds that the strongest check is to validate those keys through the Debian keyring and its web of trust. The published fingerprints are the practical route for everyone else.

What about macOS?

Apple does not publish a hash for the macOS installer. What Apple does give you is a clean download path and a clear failure message. Its bootable installer article says the download should be an app named "Install [Version Name]" in your Applications folder. If you get a message that the installer "does not appear to be a valid installer application", Apple's advice is to delete it, repair your startup disk with Disk Utility, and download it again. For organisations, Apple's note to download from Apple rather than a locally hosted update server is the security point that matters.

How do you write the ISO to a USB stick?

Pick the writer by two things: the operating system you are on now, and the image you are writing. The table below is built only from what each vendor's documentation recommends.

Every one of these overwrites the whole stick. Ubuntu's guide puts it plainly: back up anything on the stick first, because the write destroys all of it.

On Windows: Windows 11 with the Media Creation Tool

Microsoft's steps from the Windows 11 download page:

1. Download the Media Creation Tool from the "Create Windows 11 Installation Media" section.
2. Run it. You need to be an administrator.
3. Accept the license terms.
4. On "What do you want to do?", choose Create installation media for another PC.
5. Pick the language, edition and architecture (64-bit).
6. Choose USB flash drive and attach a blank stick of at least 8GB. Microsoft warns that any content on it will be deleted.

If you want to verify a hash first, download the ISO from the same page and check it with Get-FileHash. Microsoft's page covers mounting that ISO or burning it to DVD; for USB, the Media Creation Tool is its documented route. Microsoft also warns that a PC below the Windows 11 minimum requirements "won't be entitled to receive updates".

On Windows: Linux images

Windows has no built in tool for writing Linux images, so each distro names one.

Ubuntu with Rufus. Ubuntu's current guide, Create a bootable USB stick, uses Rufus from rufus.ie. Launch it, insert the stick and confirm it in the Device field, click SELECT and pick your verified ISO, then START. Keep Write in ISO Image mode when Rufus reports an ISOHybrid image, and check the device again when Rufus warns that all data will be destroyed. If the stick will not boot, Ubuntu suggests GPT with Target system set to UEFI (non CSM). Unplugging every other USB drive first removes the chance of choosing the wrong one.

Fedora with Fedora Media Writer. Fedora names Fedora Media Writer as its official and recommended tool. Download it from fedoraproject.org/workstation/download, open it, confirm the correct stick is selected, then choose "Download Automatically" or "Select .iso file" for an image you have already verified. You need a stick of at least 8GB.

Debian with balenaEtcher or USBImager. Debian's CD FAQ recommends these two for Windows users: select the ISO, select the target stick, and flash.

On macOS: a macOS installer with createinstallmedia

Apple's article 101578 is the only official route. In short:

1. Get the full installer. Apple's download article gives the Terminal route for macOS Catalina 10.15 or later:

# List the full installers available for this Mac
softwareupdate --list-full-installers

# Download one into /Applications (Apple's example version)
softwareupdate --fetch-full-installer --full-installer-version 26.6.2

If the installer opens automatically after downloading, quit it.

2. Prepare the stick. Connect it directly to the Mac. Apple says a 32GB stick has more than enough space for any macOS installer, and 16GB is enough for most earlier versions. Rename it MyVolume, the name Apple's commands expect.

3. Confirm which volume you are about to erase. createinstallmedia erases the volume you name. Before running it, check that MyVolume is the external stick and not something else:

# Show only external physical disks; MyVolume should appear here
diskutil list external physical

The external and physical filters are documented in the diskutil manual page on macOS.

4. Run the command for your version. For macOS Tahoe 26, Apple's command is:

sudo /Applications/Install\ macOS\ Tahoe.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

Apple's article lists the command for every version from OS X El Capitan 10.11 up to macOS 27 Golden Gate. Copy the line that matches the installer you downloaded. Type your administrator password when asked, then type Y to confirm erasing the volume. If Terminal asks to access files on a removable volume, click OK.

5. Finish. When Terminal says the install media is available, the stick is renamed after the installer (for example "Install macOS Tahoe"). Quit Terminal and eject the stick.

Apple notes the stick is erased as Mac OS Extended (Journaled). If Terminal cannot erase it, erase it in Disk Utility with that format and try again. When you use the installer, the Mac must be online so it can fetch firmware and model specific information.

On macOS: Linux images

Ubuntu's guide offers balenaEtcher (download the arm64 build for Apple silicon or the Intel build otherwise), or dd for people comfortable in Terminal. Read the device check section below before running dd.

Ubuntu also flags an important hardware limit: the stick it produces works on PCs and older Intel based Macs. For Apple silicon Macs, Ubuntu points to the Ubuntu Asahi community project, which Canonical does not support, and notes that hardware support is limited (Ubuntu Asahi 25.10 runs only on M1 and M2 systems, according to Ubuntu's guide).

Ubuntu's older macOS tutorial adds one useful warning: after writing, macOS may say "The disk you inserted was not readable by this computer". Do not click Initialise. Click Eject.

On Linux: graphical tools first

Ubuntu's guide recommends trying, in order, whichever is available:

• Disks (GNOME). Select the stick in the sidebar, close anything using it, open Drive Options, choose Restore Disk Image, pick the ISO and click Start Restoring. Ubuntu warns that both the stick and the disk holding your running system are listed, so pick carefully.
• Startup Disk Creator, for Ubuntu and Ubuntu based images only. Install it with sudo apt install usb-creator-gtk if it is missing.
• KDE ISO Image Writer (Ubuntu and Kubuntu 26.04 LTS and later). Install it with sudo apt install isoimagewriter. Place SHA256SUMS and SHA256SUMS.gpg beside the ISO and the tool verifies the image before writing. Ubuntu warns not to let your browser save SHA256SUMS with a .txt suffix.

Fedora users can install Fedora Media Writer, which checks the image after writing.

How do you use dd safely?

dd is the one command that every vendor here documents, and the one that every vendor warns about. Ubuntu says a wrong option, disk or file name can destroy your running system. Fedora says "there is no option to 'undo' the action" once it completes. Debian says it will overwrite your hard disk just as happily as the stick if you name the wrong device.

The rule is simple. Never type a device name you have not just confirmed with your own eyes, with the stick plugged in, by size and model.

Device check on Linux

Follow Fedora's "positively identify your USB flash drive" method, which Debian's installation guide also describes:

# 1. With the stick UNPLUGGED, list block devices
lsblk

# 2. Plug the stick in and list again
lsblk

# 3. The new whole disk device (sdX) is your stick.
#    Cross-check its SIZE against the stick's capacity.
#    Ubuntu's guide shows the transport (usb), vendor and model like this:
lsblk --scsi

Fedora also documents dmesg, where the kernel logs a line such as "Attached SCSI removable disk" with the device name. If you have more than one stick connected, Fedora says to use the manufacturer name or capacity to be sure. Check that the TRAN column says usb and the model matches the label on the stick. If anything does not match, stop.

Write on Linux

Unmount every partition on the stick, then write. Ubuntu's version:

# Unmount all file systems on the stick (replace sda with YOUR confirmed device)
sudo umount /dev/sda*

# Write the verified image to the whole disk, not a partition
sudo dd if=Downloads/ubuntu-26.04-desktop-amd64.iso of=/dev/sda bs=4M conv=fsync status=progress

# Tell the running system the stick has changed, if you want to inspect it
sudo partprobe /dev/sda

Fedora's version is the same idea:

sudo umount /dev/sdX
sudo dd if=/path/to/Fedora-Workstation-Live.iso of=/dev/sdX bs=4M status=progress && sync

And Debian's FAQ gives two forms, plain copy or dd:

# Debian: copy the hybrid image straight to the device
cp <file> <device>

# or with dd
sudo dd if=<file> of=<device> bs=16M status=progress oflag=sync

What each part does, from the dd manual page and the vendor notes: if= is the input file (your ISO). of= is the output (the stick). bs= sets how many bytes are read and written at a time; 4M is fine. status=progress prints progress. conv=fsync, oflag=sync or a trailing sync all make sure data has really reached the stick before you pull it out. The device in of= must be the whole disk, such as /dev/sdb, never a partition such as /dev/sdb1, as Debian's installation guide stresses.

Two more checks from Ubuntu's guide: make sure the stick is large enough, because the write can fail without any error if it is not, and double check both paths before pressing Enter.

Device check and write on macOS

Ubuntu's guide gives the macOS steps. The device check is the same before and after method:

# 1. Before inserting the stick
diskutil list

# 2. Insert the stick, then list again; note the new /dev/diskN
diskutil list

# 3. Unmount it (replace N with YOUR confirmed disk number)
diskutil unmountDisk /dev/diskN

# 4. Write to the raw device for speed (macOS dd uses a lowercase m)
sudo dd if=Downloads/ubuntu-26.04-desktop-amd64.iso of=/dev/rdiskN bs=4m

# 5. Eject when it finishes
diskutil eject /dev/diskN

/dev/rdiskN is the "raw" interface to the same disk and is faster, Ubuntu explains. Ubuntu's tip is to drag the ISO from Finder into Terminal to paste its full path, which avoids typing mistakes. If you see dd: Invalid number '4m', you are using GNU dd, so use bs=4M. If you see "Resource busy", the disk is still mounted; unmount the volume in Disk Utility, but do not eject it.

diskutil list marks internal disks as "internal, physical". Your stick should show as external and its size should match. If you are unsure, diskutil list external physical shows only external disks.

Check the stick, not only the download

A verified ISO can still be written badly, to a failing stick or with a cable pulled early. Graphical tools handle this for you: Fedora Media Writer checks the image after writing, and balenaEtcher runs a validation stage that confirms the stick matches the image, according to Ubuntu's macOS tutorial.

With dd on Linux you can read the same number of bytes back and hash them. dd prints the byte count when it finishes (Ubuntu's example shows 6345887744 bytes). The GNU dd manual page says a count ending in B counts bytes rather than blocks, so:

# Read back exactly as many bytes as were written, then hash them
# (replace sdX and the byte count with YOUR values)
sudo dd if=/dev/sdX bs=4M count=6345887744B status=progress | sha256sum

# Compare with the hash of the ISO itself
sha256sum ubuntu-26.04-desktop-amd64.iso

The two hashes should match. Fedora also documents a self check built into some live images: implantisomd5 embeds a checksum in the image and checkisomd5 verifies it at boot, from the isomd5sum package.

How do you mount an ISO without writing it to USB?

Sometimes you only need to look inside an image, copy a file out, or (on Windows) run an in place upgrade. Every OS can mount an ISO as a read only virtual drive.

Windows

Microsoft's Windows 11 page describes the File Explorer route: right-click the ISO, choose Properties, set "Opens with" to Windows Explorer if needed, then right-click and choose Mount. That creates a virtual drive; double-clicking setup.exe starts Windows setup, which performs an upgrade of the current OS.

In PowerShell, the Mount-DiskImage and Dismount-DiskImage cmdlets do the same:

Mount-DiskImage -ImagePath "E:\ISO-Files\My US Visit Fall 2010 Pictures.iso"
Dismount-DiskImage -ImagePath "E:\ISO-Files\My US Visit Fall 2010 Pictures.iso"

(Those are Microsoft's own example paths; swap in your ISO's path.)

macOS

hdiutil attaches disk images. Its manual page documents -readonly to force the device read only and detach to remove it:

# Attach the ISO read only; hdiutil prints the /dev/diskN it used
hdiutil attach -readonly ~/Downloads/ubuntu-26.04-desktop-amd64.iso

# Detach it when done (use the disk number hdiutil printed)
hdiutil detach diskN

Linux

The mount manual page documents loop mounts: mount creates a loop device from a regular file automatically, and -o loop requests one explicitly. Add ro for read only:

sudo mount -o loop,ro ubuntu-26.04-desktop-amd64.iso /mnt
ls /mnt
sudo umount /mnt

The manual notes that since Linux 2.6.25 a loop device allocated by mount is freed by umount.

Mounting is also a quick sanity check that the file is what its name claims.

Can you put several ISOs on one stick?

Yes. Ubuntu's guide names Ventoy under "On multiple platforms": an open source tool you install on the stick once, after which you copy ISO files onto it with a normal file browser and choose between them at boot. Ubuntu points to Ventoy's own documentation for instructions, and lists Ventoy for Linux and Windows.

Three cautions from a security point of view:

• Verify each ISO before copying it on. Ventoy boots whatever files are on the stick.
• A multi-ISO stick is a mounted, writable file system that you will plug into many machines. Keep it free of personal data, and rebuild it from verified images when in doubt.
• Debian's FAQ and installation guide warn against tools that alter the image, naming unetbootin specifically, because it can cause boot and install problems that are hard to diagnose. Fedora's documentation, by contrast, lists Unetbootin among the other tools you can use. When the distro's own documentation advises against a tool, follow that distro's advice for that distro's images.

How does Secure Boot affect a bootable USB stick?

Secure Boot is the UEFI firmware feature that refuses to run boot code that is not signed by a trusted key. It matters for install media in three ways.

Linux images are built to boot with it on. Debian's Secure Boot wiki page explains that since Debian 10 ("Buster"), Debian supports Secure Boot through a small first stage loader called shim, which is signed by Microsoft and carries Debian's own signing keys. Most x86 PCs ship with Microsoft's keys and Secure Boot turned on, so a correctly written Debian, Ubuntu or Fedora stick should boot without changing firmware settings. After installing, you can check the state from Linux:

sudo mokutil --sb-state

How you write the stick can matter. Fedora's documentation says sticks written from x86_64 images with Fedora Media Writer, GNOME Disks, dd or other dd style tools should boot in UEFI native mode, while sticks written with other tools may not be. Booting in UEFI native mode gives you a UEFI native install; booting in BIOS compatibility mode gives you a BIOS mode install. Pick UEFI unless you have a reason not to.

Old Windows media can stop booting after Secure Boot updates. Microsoft's guidance on the boot manager revocations for CVE-2023-24932 covers the Secure Boot bypass used by the BlackLotus bootkit. Microsoft warns that once the mitigations are applied, a device that fails to start might not recover from existing media, so recovery and install media must be updated. A known issue added on 30 September 2026 says that if a device has a Windows security update from April 2026 or later and the PCA 2011 revocations are enabled, Secure Version Number 5.0 is applied to the firmware, which invalidates older external boot media that was not built with Windows security updates from January 2025 or earlier. The fix is to rebuild the media with current updates. Microsoft also says each future SVN increase will require bootable media to be updated again.

On disabling Secure Boot: Microsoft's Windows 11 page says that if your USB stick does not appear as a boot option, you may need to ask the PC maker how to temporarily disable Secure Boot. Treat that as a last resort, turn it back on after installing, and first try rebuilding the stick with the vendor's current tool and current image. Debian notes that disabling Secure Boot is not needed for its standard kernels.

How do you boot from the stick?

On a PC, restart and press the boot menu key as it starts (Microsoft mentions F2, F12, Delete or Esc; Fedora adds Tab and F11). On an Apple silicon Mac, hold the power button until startup options appear. On an Intel Mac, hold Option (Alt) at power on; an Ubuntu stick shows as "EFI Boot". Microsoft notes that if you changed the boot order to install, you may need to revert it afterwards, and Fedora warns against changing firmware settings you do not understand.

Step by step: build a verified Ubuntu stick on Linux

This puts the pieces together for the most common case. Every command comes from the Ubuntu and Fedora documents cited above.

# 0. Work in the folder that holds the ISO, SHA256SUMS and SHA256SUMS.gpg
cd ~/Downloads

# 1. Verify the signature on the checksum list
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
#    (if "No public key": fetch the keys, compare fingerprints, verify again)

# 2. Verify the ISO against the list
sha256sum -c SHA256SUMS 2>&1 | grep OK

# 3. Identify the stick: run with it unplugged, then plugged in
lsblk
lsblk
lsblk --scsi     # confirm TRAN is usb and the model and size match

# 4. Unmount it (replace sda with YOUR confirmed device)
sudo umount /dev/sda*

# 5. Write the image to the whole disk
sudo dd if=ubuntu-26.04-desktop-amd64.iso of=/dev/sda bs=4M conv=fsync status=progress

# 6. Optional: read back and hash, using the byte count dd printed
sudo dd if=/dev/sda bs=4M count=6345887744B status=progress | sha256sum

Stop at step 2 if you do not see "Good signature" and an OK line. Stop at step 3 if the size or model do not match the stick in your hand.

How do you keep install media current, and how do you reuse the stick afterwards?

Refresh it. An old stick installs an old OS that then needs months of updates, if it boots at all after Secure Boot changes. Rebuild from a fresh, verified image after new point releases and after any Microsoft Secure Boot SVN change. Run Windows Update or your distro's updater straight after installing, as Microsoft's page advises.

Keep the ISO with its proof. Store the checksum file and signature beside the ISO, with the date and key fingerprint you used, so it can be re-verified later. Delete ISOs you will not use again, and the macOS installer app once the stick is made (Apple says this is fine).

Return the stick to normal storage. Fedora recommends Fedora Media Writer's restore option. GNOME Disks or macOS Disk Utility can also reformat it; Ubuntu warns that choosing the wrong device or partition in Disk Utility loses data. Positively identify the stick first, exactly as before writing.

Common mistakes

• Downloading from a search ad or portal. None of these vendors ship a "faster downloader" wrapper around an ISO.
• Checking the hash but not the signature. Whoever can replace an ISO can replace the checksum beside it.
• Importing a key without checking its fingerprint against the vendor's own page.
• Copying the ISO onto the stick as a file. It will not boot.
• Writing to a partition (/dev/sdb1) instead of the whole disk (/dev/sdb).
• Guessing the device name. sda is often your system disk.
• Pulling the stick before data is flushed. Use conv=fsync, oflag=sync or sync.
• Clicking Initialise on macOS after writing a Linux image. Eject instead.
• Disabling Secure Boot by reflex. Rebuild the stick with current media first.
• Keeping one old stick forever. Old media installs unpatched software and may not boot.

Fix it without waiting for upstream

A verified ISO gives you a clean operating system on day one. The software you then install and build on top of it, and the base images your containers start from, are where most of the ongoing patch work sits.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

Where Safeguard fits, honestly

Safeguard does not download, verify or write ISO files, and it does not check firmware or Secure Boot settings. The vendor steps above are the controls for that job.

Safeguard helps with the software you then run and build. The Safeguard CLI scans a project directory, a container image or an SBOM file, matches components against vulnerability databases, and shows which projects contain a given component and version. That includes the OS packages inside container images built from Ubuntu, Debian or Fedora base images. It does not cover the host kernel or firmware of the PC you installed; those patches come from your OS vendor.

FAQ

How do I make a bootable USB from an ISO on Windows 11?

For Windows 11, use Microsoft's Media Creation Tool with a blank stick of at least 8GB. For Linux, use the distro's recommended tool: Rufus for Ubuntu, Fedora Media Writer for Fedora, balenaEtcher or USBImager for Debian. Verify the ISO first.

Can I just copy an ISO file to a USB drive?

No. Copying puts the ISO on the stick as a single file, which firmware cannot boot. A writer rewrites the whole stick with the image's partitions and boot loader. The exception is a Ventoy stick, which is designed to boot ISO files copied onto it.

How do I check the SHA256 of an ISO?

On Windows, run Get-FileHash in PowerShell. On Linux, run sha256sum -c against the signed checksum file. On macOS, use shasum -a 256. Then check the signature on the checksum file too.

What does "gpg: WARNING: This key is not certified with a trusted signature" mean?

It means you have not personally signed the vendor's key. Ubuntu explains that "Good signature" is the result that matters. What makes the result trustworthy is that you compared the key's fingerprint with the one the vendor publishes on its own site.

Why is there no macOS ISO?

Apple ships macOS as an "Install macOS" app, not an ISO. You make a USB installer with the createinstallmedia command inside that app, per Apple's article 101578.

Which USB stick size do I need?

At least 8GB for Windows 11, Fedora and current Ubuntu images. Apple says 32GB is more than enough for any macOS installer and 16GB covers most earlier versions.

Why won't my USB stick show up in the boot menu?

Make sure it was written with an image writer, not copied, and press the boot menu key early. Ubuntu suggests rewriting with GPT and UEFI (non CSM) in Rufus. Try a fresh stick from current media before touching Secure Boot.

Is dd dangerous?

It is exactly as dangerous as the device name you give it. List disks before and after plugging the stick in, match size and model, and double check of=. Otherwise use the vendor's graphical tool.

How do I mount an ISO without burning it?

On Windows, right-click the ISO and choose Mount, or use Mount-DiskImage. On macOS, run hdiutil attach -readonly with the file path. On Linux, run sudo mount -o loop,ro with the ISO and a mount point.

How do I turn my bootable USB back into a normal drive?

Use Fedora Media Writer's restore option, GNOME Disks or macOS Disk Utility, after confirming you selected the stick.

See how Safeguard would help

None of these demos write USB sticks. They show the software side once the new machine is up. To try them yourself, download Safeguard and follow the CLI docs.

The first demo is a real CLI session. You install the CLI, open the interactive terminal with safeguard, and ask it to "fix the lodash CVE in this repo"; it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. On a freshly installed machine, the same flow brings a cloned project up to fixed dependency versions with a person approving every step.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with its device code, then scans from the terminal. If you rebuilt a workstation from verified media to control what runs on it, this keeps scanning on hardware you control too (how the local runner works).

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. Once your new machine is set up, you can ask Claude about the vulnerabilities in your projects from a chat, with access limited to the tools you picked.

Click through it at your own pace, or open it full screen.

For the hardware side of USB sticks, including encrypted drives and recovery kits, see hardware-encrypted USB drives and bootable recovery media.

Quick check

Sources

• Microsoft: Download Windows 11
• Microsoft: Download Windows 10
• Microsoft Learn: Get-FileHash
• Microsoft Learn: Mount-DiskImage
• Microsoft Learn: Dismount-DiskImage
• Microsoft Support: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
• Ubuntu: How to verify your Ubuntu download
• Ubuntu Desktop documentation: Create a bootable USB stick
• Ubuntu: Create a bootable USB stick on Windows (older tutorial)
• Ubuntu: Create a bootable USB stick on macOS (older tutorial)
• Ubuntu: Create a bootable USB stick on Ubuntu (older tutorial)
• Fedora: Security, verify your download
• Fedora Docs: Creating and using a live installation image
• Debian: Verifying authenticity of Debian images
• Debian: Frequently asked questions about Debian CD/DVD/USB images
• Debian installation guide: Preparing files for USB memory stick booting
• Debian Wiki: SecureBoot
• Apple Support: Create a bootable installer for macOS (101578)
• Apple Support: How to download and install macOS (102662)
• GnuPG manual: Operational GPG commands
• man7.org: dd(1)
• man7.org: sha256sum(1)
• man7.org: lsblk(8)
• man7.org: mount(8)
• macOS manual pages for hdiutil, diskutil and shasum (installed with macOS; run man hdiutil)
• Safeguard: Checksum vs signature, which to trust for a download
• Safeguard: Hardware-encrypted USB drives and bootable recovery media
• Safeguard: How the local runner and offline mode work

Last reviewed: 23 October 2026.