Acquiring Disk Image With Dd And Dcfldd

This walks you through creating forensically sound disk images using dd and dcfldd, covering everything from write-blocking the source drive to hash verification. You get practical commands for both tools, with dcfldd being the better choice since it handles SHA-256 hashing during acquisition instead of as a separate step. The workflow includes proper evidence documentation, split imaging for large drives, and integrity verification that'll hold up in court. It's comprehensive enough that you could hand it to a junior analyst during an incident response and they'd know exactly what commands to run and why the conv=noerror,sync flags matter for maintaining offset alignment.

skills.sh installs: 688
GitHub stars: 35.9K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add mukul975/anthropic-cybersecurity-skills --skill acquiring-disk-image-with-dd-and-dcfldd --agent claude-code

Installs into .claude/skills of the current project.

Files

Acquiring Disk Image with dd and dcfldd

When to Use

When you need to create a forensic copy of a suspect drive for investigation
During incident response when preserving volatile disk evidence before analysis
When law enforcement or legal proceedings require a verified bit-for-bit copy
Before performing any destructive analysis on a storage device
When acquiring images from physical drives, USB devices, or memory cards

Prerequisites

Linux-based forensic workstation (SIFT, Kali, or any Linux distro)
dd (pre-installed on all Linux systems) or dcfldd (enhanced forensic version)
Write-blocker hardware or software write-blocking configured
Destination drive with sufficient storage (larger than source)
Root/sudo privileges on the forensic workstation
SHA-256 or MD5 hashing utilities (sha256sum, md5sum)

Workflow

Step 1: Identify the Target Device and Enable Write Protection

# List all connected block devices to identify the target
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL

# Verify the device details
fdisk -l /dev/sdb

# Enable software write-blocking (if no hardware blocker)
blockdev --setro /dev/sdb

SKILL.md on GitHub