Menu

Individual skill

acquiring-disk-image-with-dd-and-dcfldd

0upvotes

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.

internal/tools/skills/data/digital-forensics/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md

Read pinned source

Source commit d42f381ad34843e71a42658e5c57290c713e85af

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,317
Repository last updated
Nov 8, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Acquiring Disk Image with dd and dcfldd

## When to Use
- When you need to create a forensic copy of a suspect drive for investigation
- During incident response when preserving volatile disk evidence before analysis
- When law enforcement or legal proceedings require a verified bit-for-bit copy
- Before performing any destructive analysis on a storage device
- When acquiring images from physical drives, USB devices, or memory cards

## Detection Gaps & Validation

- **Hidden areas a naive `dd` silently drops:** an HPA or DCO makes the disk report fewer sectors than it physically has, so `dd if=/dev/sdb` captures less than the full media. Check `hdparm -N /dev/sdb` (HPA) and `hdparm --dco-identify /dev/sdb` (DCO) and compare against the label / `smartctl -i` native capacity before imaging; document or remove the HPA per policy.
- **`conv=noerror,sync` masks bad sectors:** zero-padding keeps offsets aligned but the gaps then look like real null data. Always read `dcfldd`'s `errlog` (or a `ddrescue` mapfile) and record every unreadable LBA - never present a padded region as recovered content.
- **Hash mismatch is not automatically tampering:** a source-vs-image mismatch most often means a missing write-blocker, a failing disk remapping sectors, or a volume that auto-mounted/fsck'd during read. Compare `source_hash_before` vs `source_hash_after`; if the source changed, the imaging chain is at fault, not the suspect.
Back to top