acquiring-disk-image-with-dd-and-dcfldd

1# Acquiring Disk Image with dd and dcfldd
2 
3## When to Use
4- When you need to create a forensic copy of a suspect drive for investigation
5- During incident response when preserving volatile disk evidence before analysis
6- When law enforcement or legal proceedings require a verified bit-for-bit copy
7- Before performing any destructive analysis on a storage device
8- When acquiring images from physical drives, USB devices, or memory cards
9 
10## Prerequisites
11- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)
12- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)
13- Write-blocker hardware or software write-blocking configured
14- Destination drive with sufficient storage (larger than source)
15- Root/sudo privileges on the forensic workstation
16- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)
17 
18## Workflow
19 
20### Step 1: Identify the Target Device and Enable Write Protection
21 
22```bash
23# List all connected block devices to identify the target
24lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL
25 
26# Verify the device details
27fdisk -l /dev/sdb
28 
29# Enable software write-blocking (if no hardware blocker)
30blockdev --setro /dev/sdb
31 
32# Verify read-only status
33blockdev --getro /dev/sdb
34# Output: 1 (means read-only is enabled)
35 
36# Alternatively, use udev rules for persistent write-blocking
37echo 'SUBSYSTEM=="block", ATTRS{serial}=="WD-WCAV5H861234", ATTR{ro}="1"' > /etc/udev/rules.d/99-writeblock.rules
38udevadm control --reload-rules
39```
40…