acquiring-disk-image-with-dd-and-dcfldd

name	acquiring-disk-image-with-dd-and-dcfldd
description	Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
domain	cybersecurity
subdomain	digital-forensics
tags	["forensics","disk-imaging","evidence-acquisition","dd","dcfldd","hash-verification"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.AN-03","DE.AE-02","RS.MA-01"]
mitre_attack	["T1006","T1005","T1025","T1074.001"]

Acquiring Disk Image with dd and dcfldd

When to Use

• When you need to create a forensic copy of a suspect drive for investigation
• During incident response when preserving volatile disk evidence before analysis
• When law enforcement or legal proceedings require a verified bit-for-bit copy
• Before performing any destructive analysis on a storage device
• When acquiring images from physical drives, USB devices, or memory cards

Prerequisites

• Linux-based forensic workstation (SIFT, Kali, or any Linux distro)
• dd (pre-installed on all Linux systems) or dcfldd (enhanced forensic version)
• Write-blocker hardware or software write-blocking configured
• Destination drive with sufficient storage (larger than source)
• Root/sudo privileges on the forensic workstation
• SHA-256 or MD5 hashing utilities (sha256sum, md5sum)

Workflow

Step 1: Identify the Target Device and Enable Write Protection

# List all connected block devices to identify the target
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL

# Verify the device details
fdisk -l /dev/sdb

# Enable software write-blocking (if no hardware blocker)
blockdev --setro /dev/sdb

# Verify read-only status
blockdev --getro /dev/sdb
# Output: 1 (means read-only is enabled)

# Alternatively, use udev rules for persistent write-blocking
echo 'SUBSYSTEM=="block", ATTRS{serial}=="WD-WCAV5H861234", ATTR{ro}="1"' > /etc/udev/rules.d/99-writeblock.rules
udevadm control --reload-rules

Step 2: Prepare the Destination and Document the Source

# Create case directory structure
mkdir -p /cases/case-2024-001/{images,hashes,logs,notes}

# Document source drive information
hdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt

# Record the serial number and model
smartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt

# Pre-hash the source device
sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt