acquiring-disk-image-with-dd-and-dcfldd

# Acquiring Disk Image with dd and dcfldd ## When to Use - When you need to create a forensic copy of a suspect drive for investigation - During incident response when preserving volatile disk evidence before analysis - When law enforcement or legal proceedings require a verified bit-for-bit copy - Before performing any destructive analysis on a storage device - When acquiring images from physical drives, USB devices, or memory cards ## Prerequisites - Linux-based forensic workstation (SIFT, Kali, or any Linux distro) - `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version) - Write-blocker hardware or software write-blocking configured - Destination drive with sufficient storage (larger than source) - Root/sudo privileges on the forensic workstation - SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`) ## Workflow ### Step 1: Identify the Target Device and Enable Write Protection ```bash # List all connected block devices to identify the target lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL # Verify the device details fdisk -l /dev/sdb # Enable software write-blocking (if no hardware blocker) blockdev --setro /dev/sdb # Verify read-only status blockdev --getro /dev/sdb # Output: 1 (means read-only is enabled) # Alternatively, use udev rules for persistent write-blocking echo 'SUBSYSTEM=="block", ATTRS{serial}=="WD-WCAV5H861234", ATTR{ro}="1"' > /etc/udev/rules.d/99-writeblock.rules udevadm control --reload-rules ``` ### Step 2: Prepare the Destination and Document the Source ```bash # Create case directory structure mkdir -p /cases/case-2024-001/{images,hashes,logs,notes} # Document source drive information hdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt # Record the serial number and model smartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt # Pre-hash the source device sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt ``` ### Step 3: Acquire the Image Using dd ```bash # Basic dd acquisition with progress and error handling dd if=/dev/sdb of=/cases/case-2024-001/images/evidence.dd \ bs=4096 \ conv=noerror,sync \ status=progress 2>&1 | tee /cases/case-2024-001/logs/dd_acquisition.log # For compressed images to save space dd if=/dev/sdb bs=4096 conv=noerror,sync status=progress | \ gzip -c > /cases/case-2024-001/images/evidence.dd.gz # Using dd with a specific count for partial acquisition dd if=/dev/sdb of=/cases/case-2024-001/images/first_1gb.dd \ bs=1M count=1024 status=progress ``` ### Step 4: Acquire Using dcfldd (Preferred Forensic Method) ```bash # Install dcfldd if not present apt-get install dcfldd # Acquire image with built-in hashing and split output dcfldd if=/dev/sdb \ of=/cases/case-2024-001/images/evidence.dd \ hash=sha256,md5 \ hashwindow=1G \ hashlog=/cases/case-2024-001/hashes/acquisition_hashes.txt \ bs=4096 \ conv=noerror,sync \ errlog=/cases/case-2024-001/logs/dcfldd_errors.log