adriannoes/awesome-agentic-ai/acquiring-disk-image-with-dd-and-dcfldd

Name: acquiring-disk-image-with-dd-and-dcfldd
Author: adriannoes

Claude Code and agent skill by adriannoes/awesome-agentic-ai

Trust tier 2

community

LLM review pending

By adriannoes
Design
adriannoes/awesome-agentic-ai
cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md
Updated 27 Oct 2026
Version 1.0.01 version recorded

Source check pending

Checking that the SKILL.md file is still in the repository.

Create forensically sound bit-for-bit disk images using dd and dcfldd

Install

npx vskill@latest install adriannoes/awesome-agentic-ai/acquiring-disk-image-with-dd-and-dcfldd

SKILL.md

Acquiring Disk Image with dd and dcfldd

When to Use

When you need to create a forensic copy of a suspect drive for investigation
During incident response when preserving volatile disk evidence before analysis
When law enforcement or legal proceedings require a verified bit-for-bit copy
Before performing any destructive analysis on a storage device
When acquiring images from physical drives, USB devices, or memory cards

Prerequisites

Linux-based forensic workstation (SIFT, Kali, or any Linux distro)
dd (pre-installed on all Linux systems) or dcfldd (enhanced forensic version)
Write-blocker hardware or software write-blocking configured
Destination drive with sufficient storage (larger than source)
Root/sudo privileges on the forensic workstation
SHA-256 or MD5 hashing utilities (sha256sum, md5sum)

Workflow

Step 1: Identify the Target Device and Enable Write Protection

bash

# List all connected block devices to identify the target
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL
 
# Verify the device details
fdisk -l /dev/sdb
 
# Enable software write-blocking (if no hardware blocker)
blockdev --setro /dev/sdb
 
# Verify read-only status
blockdev --getro /dev/sdb
# Output: 1 (means read-only is enabled)
 
# Alternatively, use udev rules for persistent write-blocking
echo 'SUBSYSTEM=="block", ATTRS{serial}=="WD-WCAV5H861234", ATTR{ro}="1"' > /etc/udev/rules.d/99-writeblock.rules
udevadm control --reload-rules

Step 2: Prepare the Destination and Document the Source

bash

# Create case directory structure
mkdir -p /cases/case-2024-001/{images,hashes,logs,notes}
 
# Document source drive information
hdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt
 
# Record the serial number and model
smartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt
 
# Pre-hash the source device
sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt

Step 3: Acquire the Image Using dd

bash

# Basic dd acquisition with progress and error handling
dd if=/dev/sdb of=/cases/case-2024-001/images/evidence.dd \
   bs=4096 \
   conv=noerror,sync \
   status=progress 2>&1 | tee /cases/case-2024-001/logs/dd_acquisition.log
 
# For compressed images to save space
dd if=/dev/sdb bs=4096 conv=noerror,sync status=progress | \
   gzip -c > /cases/case-2024-001/images/evidence.dd.gz
 
# Using dd with a specific count for partial acquisition
dd if=/dev/sdb of=/cases/case-2024-001/images/first_1gb.dd \
   bs=1M count=1024 status=progress

Step 4: Acquire Using dcfldd (Preferred Forensic Method)

bash

# Install dcfldd if not present
apt-get install dcfldd
 
# Acquire image with built-in hashing and split output
dcfldd if=/dev/sdb \
   of=/cases/case-2024-001/images/evidence.dd \
   hash=sha256,md5 \
   hashwindow=1G \
   hashlog=/cases/case-2024-001/hashes/acquisition_hashes.txt \
   bs=4096 \
   conv=noerror,sync \
   errlog=/cases/case-2024-001/logs/dcfldd_errors.log
 
# Split large images into manageable segments
dcfldd if=/dev/sdb \
   of=/cases/case-2024-001/images/evidence.dd \
   hash=sha256 \
   hashlog=/cases/case-2024-001/hashes/split_hashes.txt \
   bs=4096 \
   split=2G \
   splitformat=aa
 
# Acquire with verification pass
dcfldd if=/dev/sdb \
   of=/cases/case-2024-001/images/evidence.dd \
   hash=sha256 \
   hashlog=/cases/case-2024-001/hashes/verification.txt \
   vf=/cases/case-2024-001/images/evidence.dd \
   verifylog=/cases/case-2024-001/logs/verify.log

Step 5: Verify Image Integrity

bash

# Hash the acquired image
sha256sum /cases/case-2024-001/images/evidence.dd | \
   tee /cases/case-2024-001/hashes/image_hash.txt
 
# Compare source and image hashes
diff <(sha256sum /dev/sdb | awk '{print $1}') \
     <(sha256sum /cases/case-2024-001/images/evidence.dd | awk '{print $1}')
 
# If using split images, verify each segment
sha256sum /cases/case-2024-001/images/evidence.dd.* | \
   tee /cases/case-2024-001/hashes/split_image_hashes.txt
 
# Re-hash source to confirm no changes occurred
sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_after.txt
diff /cases/case-2024-001/hashes/source_hash_before.txt \
     /cases/case-2024-001/hashes/source_hash_after.txt

Step 6: Document the Acquisition Process

bash

# Generate acquisition report
cat << 'EOF' > /cases/case-2024-001/notes/acquisition_report.txt
DISK IMAGE ACQUISITION REPORT
==============================
Case Number: 2024-001
Date/Time: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
Examiner: [Name]
 
Source Device: /dev/sdb
Model: [from hdparm output]
Serial: [from hdparm output]
Size: [from fdisk output]
 
Acquisition Tool: dcfldd v1.9.1
Block Size: 4096
Write Blocker: [Hardware/Software model]
 
Image File: evidence.dd
Image Hash (SHA-256): [from hash file]
Source Hash (SHA-256): [from hash file]
Hash Match: YES/NO
 
Errors During Acquisition: [from error log]
EOF
 
# Compress logs for archival
tar -czf /cases/case-2024-001/acquisition_package.tar.gz \
   /cases/case-2024-001/hashes/ \
   /cases/case-2024-001/logs/ \
   /cases/case-2024-001/notes/

Key Concepts

Concept	Description
Bit-for-bit copy	Exact replica of source including unallocated space and slack space
Write blocker	Hardware or software mechanism preventing writes to evidence media
Hash verification	Cryptographic hash comparing source and image to prove integrity
Block size (bs)	Transfer chunk size affecting speed; 4096 or 64K typical for forensics
conv=noerror,sync	Continue on read errors and pad with zeros to maintain offset alignment
Chain of custody	Documented trail proving evidence has not been tampered with
Split imaging	Breaking large images into smaller files for storage and transport
Raw/dd format	Bit-for-bit image format without metadata container overhead

Tools & Systems

Tool	Purpose
dd	Standard Unix disk duplication utility for raw imaging
dcfldd	DoD Computer Forensics Laboratory enhanced version of dd with hashing
dc3dd	Another forensic dd variant from the DoD Cyber Crime Center
sha256sum	SHA-256 hash calculation for integrity verification
blockdev	Linux command to set block device read-only mode
hdparm	Drive identification and parameter reporting
smartctl	S.M.A.R.T. data retrieval for drive health and identification
lsblk	Block device enumeration and identification

Common Scenarios

Scenario 1: Acquiring a Suspect Laptop Hard Drive Connect the drive via a Tableau T35u hardware write-blocker, identify as /dev/sdb, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.

Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation Use software write-blocking with blockdev --setro, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.

Scenario 3: Remote Acquisition Over Network Use dd piped through netcat or ssh for remote acquisition: ssh root@remote "dd if=/dev/sda bs=4096" | dd of=remote_image.dd bs=4096, hash both ends independently to verify transfer integrity.

Scenario 4: Acquiring from a Failing Drive Use ddrescue first to recover readable sectors, then use dd with conv=noerror,sync to fill gaps with zeros, document which sectors were unreadable in the error log.

Output Format

Acquisition Summary:
  Source:       /dev/sdb (500GB Western Digital WD5000AAKX)
  Destination:  /cases/case-2024-001/images/evidence.dd
  Tool:         dcfldd 1.9.1
  Block Size:   4096 bytes
  Duration:     2h 15m 32s
  Bytes Copied: 500,107,862,016
  Errors:       0 bad sectors
  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1
  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1
  Verification:    PASSED - Hashes match

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingcursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md

Popularity

Repository stars: 63
Repository forks: 18
7-day trend score: 26

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/adriannoes/awesome-agentic-ai/acquiring-disk-image-with-dd-and-dcfldd/badge)](https://verified-skill.com/skills/adriannoes/awesome-agentic-ai/acquiring-disk-image-with-dd-and-dcfldd)

Something wrong with this skill or its page? Tell us.