Disk Acquisition
Creating forensic images of drives and partitions.
-
dd vs dc3dd vs dcfldd: speed and reliability test
A real test of dd, dc3dd and dcfldd: speed with and without hashing, with a fast source and with a 100 MB/s drive, and what happens to the image when the drive has bad sectors.
-
dcfldd command examples: hash, hashlog, split and verify
dcfldd commands for forensic acquisition: calculate the hash while you copy, save it with hashlog, show the percentage, split the image and verify it against the source. All examples tested with dcfldd 1.9.1.
-
Forensic imaging with dd, dc3dd and dcfldd
Three ways to create a raw forensic image of a drive from the Linux command line — dd, dc3dd and dcfldd — with the options that matter and when to use each one.
-
Drive acquisition with dc3dd
Step-by-step acquisition of a drive with dc3dd: identify the device, create a raw image with on-the-fly hashing and check the log.