Preserve disk evidence in a hash-verified image.
What it does
Creates hash-verified disk images and acquisition records for forensic investigations.
When to use it
Use when preserving storage-device evidence for investigation, incident response, legal proceedings, or analysis that could alter the original.
How to use it
Give it a source device and case directory; it creates a disk image, compares hashes, and records the acquisition.
What you provide
- the source device
- the case directory
Latest review
What you need · 6
Requires a Linux forensic workstation with root or sudo privileges.
Requires a destination drive with sufficient storage, larger than the source.
Access · 3
This skill
block devices
Read
Reads connected storage devices
dcfldd
Execute
Installs dcfldd when missing