Imaging with "Dcfldd"
dcfldd is an enhanced version of dd developed by the U.S. Department of Defense Computer Forensics Lab. It has some useful features for forensic investigators such as:
- On-the-fly hashing of the transmitted data.
- Progress bar of how much data has already been sent.
- Wiping of disks with known patterns.
- Verification that the image is identical to the original drive, bit-for-bit.
- Simultaneous output to more than one file/disk is possible.
- The output can be split into multiple files.
- Logs and data can be piped into external applications.
The program only produces raw image files.
(Source: http://www.forensicswiki.org/wiki/Dcfldd)
Example:
|
dcfldd if=/dev/sda hash=md5 md5log=md5.txt hashconv=after \ bs=512 conv=noerror,sync split=2048GB splitformat=aa of=image.dd
|