acquiring-disk-image-with-dd-and-dcfldd

name	acquiring-disk-image-with-dd-and-dcfldd
description	Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification. Use when createing forensically sound bit-for-bit disk images using dd and dcfldd.
domain	cybersecurity
tags	["forensics","disk-imaging","evidence-acquisition","dd","dcfldd","hash-verification"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Acquiring Disk Image With Dd And Dcfldd

Overview

Cybersecurity skill for acquiring disk image with dd and dcfldd. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "acquiring disk image with dd and dcfldd"

• "Create forensically sound bit-for-bit disk images using dd and dcfldd while pres"

• When you need to create a forensic copy of a suspect drive for investigation

• During incident response when preserving volatile disk evidence before analysis

• When law enforcement or legal proceedings require a verified bit-for-bit copy

• Before performing any destructive analysis on a storage device

• When acquiring images from physical drives, USB devices, or memory cards

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Linux-based forensic workstation (SIFT, Kali, or any Linux distro)
• dd (pre-installed on all Linux systems) or dcfldd (enhanced forensic version)
• Write-blocker hardware or software write-blocking configured
• Destination drive with sufficient storage (larger than source)
• Root/sudo privileges on the forensic workstation
• SHA-256 or MD5 hashing utilities (sha256sum, md5sum)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}