Skip to content

Imaging with "Dcfldd"

dcfldd is an enhanced version of dd developed by the U.S. Department of Defense Computer Forensics Lab. It has some useful features for forensic investigators such as:
  • On-the-fly hashing of the transmitted data.
  • Progress bar of how much data has already been sent.
  • Wiping of disks with known patterns.
  • Verification that the image is identical to the original drive, bit-for-bit.
  • Simultaneous output to more than one file/disk is possible.
  • The output can be split into multiple files.
  • Logs and data can be piped into external applications.
The program only produces raw image files.
dcfldd if=/dev/sda hash=md5 md5log=md5.txt hashconv=after \ bs=512 conv=noerror,sync split=2048GB splitformat=aa of=image.dd


Nice free tool from "DiskInternals"

Today, for some reasons I needed a quick access to some older linux partitions. After a quick search on Google I found the "DiskInternals Linux Reader" which seems do the job and which is absolutly free, too :-)
After a quick installation, the tool works like the windows explorer. But remember, the access is "read-only"!
Enjoy yourself!
Imprint | Contact | Privacy Statement