Tem que ser 'dd'? O GNU 'ddrescue' tem uma conveniente opção "reversa":
# copy the last 1K from '/dev/sdc' to '/tmp/c_end'
% ddrescue --reverse --max-size=1Ki /dev/sdc /tmp/c_end
Press Ctrl-C to interrupt
rescued: 1024 B, errsize: 0 B, current rate: 1024 B/s
ipos: 0 B, errors: 0, average rate: 1024 B/s
opos: 0 B, time from last successful read: 0 s
Finished