# Disk acquisition with dcfldd

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2Fd9sIq6fu7au9mQONJ61Z%2Fdd_tools3-613x381.png?alt=media\&token=5cd678a5-4da1-4faf-9000-02b07b132531)

### 1. Introduction

This is an alternative approach for dd to create a disk image file for further forensic analysis.

> dcfldd is a modified version of GNU originally created by Nicholas Harbour from the DoD\
> Computer Forensics Laboratory (DCFL). It supports hashing, fast disk wiping (through patterns)\
> and status output

### 2. Image creation with dcfldd

This command will do the same like in the last exercise, but will also automatically create a md5 hash file

`dcfldd if=/dev/sdc hash=md5,sha256 md5log=md5.log sha256log=sha.log`\
`of=evidence2.img`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FgLRRzv8B6ygyBrnatrdh%2Fdd5.png?alt=media\&token=83ec3431-6d93-4663-98b2-1d7ded8c1bea)

If we compare the md5 sum with the evidence.img file from the last exercise, I’ll get the same value:

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2Fllp3QA3anvkf5Q6IABRt%2Fdd6.png?alt=media&#x26;token=ec467035-7c44-46ea-b9e2-1c816d0c7b98" alt=""></div>

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FWNglplvSJzdjKpGifygG%2Fdd4.png?alt=media&#x26;token=6c3b8705-cecd-451b-905b-d732a8cdfa25" alt=""></div>

### 3. Split disk image&#x20;

There are some other cool stuff we can do, like splitting the disk image file into different parts

`dcfldd if=/dev/sdc hash=md5,sha256 md5log=md5.log split=64M splitformat=000 sha256log=sha.log of=evidence_3.img`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FkeAkdkhQpGr3EXbDRWhR%2Fdd7.png?alt=media\&token=1b498b9f-c990-4d3f-99cf-9fa1345068c9)

As we can see, this give us 4 parts of a 256MB disk file.

This approach can help while imaging a large evidence disk. The smaller parts of the image can be then sent over the internet or carried on relatively smaller portable storage device

If we choose that option, the analyst needs to know how he can set the splittet parts together. Let’s use the following command

`cat evidence_3.img.0* > evidence4.img`

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2F68oPQGs8VyszA4sEEj7w%2Fdd8.png?alt=media&#x26;token=c7c2c603-5882-4b29-a2dc-d7852af070d4" alt=""></div>

### 4. Summary

{% embed url="https://vimeo.com/676868929" %}
