acquiring-disk-image-with-dd-and-dcfldd

What problem does it solve?

Forensic investigators often struggle to produce verifiable, bit-for-bit copies of storage media while preserving evidence integrity across diverse devices.

Core Features & Use Cases

• End-to-end imaging workflow using dd and dcfldd with built-in hashing (SHA-256) to verify integrity.
• Supports write-blocked acquisition, hash logging, split imaging, and acquisition reporting.
• Use Case: Incident response, legal discovery, and archival verification across HDDs, SSDs, and USB drives.

Quick Start

Create a forensic image of a target device (e.g., /dev/sdb) into a case folder, verify the image hash against the source, and generate a JSON acquisition report.