I thought I would add that if dd is used with a mounted device, then likely (A) read would have changed bytes during the read (possible corruption), or (B) bytes would change during the write (possible corruption), or (C) bytes would block during simultaneous write (dd stuck). It is important to know the mount status if either reading or writing.
Before continuing, what you are describing is that the tools are doing what they were supposed to do. This is not related to a Jetson itself, but Linux in general. This is even true for other operating systems using other tools (though tool names would change) and is not just a Linux issue.
Also, ext4 partitions keep statistics. Certain details like mount count are used for maintenance software to decide if, after a certain number of mounts, the filesystem should be checked even if no error exists. Or, if the journal is not flushed, what content to back out (a mounted partition can have content in it which is cached, but not written, and using dd in that time would cause a different content than what you think is on the disk). Even if there is nothing more than a mount count statistic change, then you could expect a different checksum despite the filesystem otherwise being an exact copy. You would need to make such a checksum without either filesystem ever being mounted. A running rootfs cannot be cloned in the usual way.
The proper tool for a running filesystem is one which understands ext4 itself, and dd only understands block devices as binary data with no concept of ext4. That tool would be rsync, but it produces a copy of the contents of a filesystem, whereas dd produces copies of a partition. You would not get a matching checksum by this method for the partition as a whole; what you would get are individual file contents which match checksums, along with certain metadata (e.g., permissions, but arguments to rsync can change which metadata is an exact duplicate, versus translated).
If you use dd you don’t need to partition, nor format, as this copies the partition and filesystem verbatim without even knowing it. If you are to use rsync, then you must first create a partition and a filesystem (preferably blank, or an old release of the same thing being updated). For rsync to work you have the reverse condition of dd: dd wants no mount or read-only, whereas rsync must be mounted (although read-only is better, it can work read-write). Assuming you mounted “/dev/nvme0n1p1” on custom location “/mnt/nvme” (you would have had to have created that partition and formatted it as ext4), and that “/dev/mmcblk0p1” is the root filesystem (mounted on “/”), here is one example of using rsync (there are lots of options):
sudo rsync -avcrltxAP --info=progress2,stats2 --delete-before --numeric-ids --exclude '.gvfs' --exclude 'lost+found' / /mnt/nvme
In the above note that “/” is the source, and “/mnt/nvme” is the destination, and that both are mounted. This means the destination already has a partition with an empty ext4 filesystem on it. This excludes special subdirectories “lost+found/” (an ext4 place to store corruption failures) and “.gvfs” (a “synthetic” filesystem used for security and not part of the hard drive).
A very important point to note is the “-x”: Since this is a mounted filesystem, this means that “/” will contain (via being a tree) other partitions which are not part of the hard disk, e.g., “/proc”, “/sys”, and “/dev”. The “-x” says to not cross filesystems, and to stick to the original filesystem (technically, with “-x”, it shouldn’t need “--exclude .gvfs”).
The “--numeric-ids” is important if this ever leaves the original system and gets copied to another Linux system since copy from one Linux to another could result in file ownership translation (e.g., suppose you have user “nvidia” on the Jetson, but not on the PC…then the PC would translate this unless “--numeric-ids” is used…flashing back to the Jetson would not do what you expect without this option).
Bit tip: Use option “--dry-run” if you want to see the messages as a test, but don’t want it to really write. Then, if it does what you want, remove the “--dry-run”.