# Acquiring Disk Image With Dd And Dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic...

- Repository: https://github.com/mukul975/Anthropic-Cybersecurity-Skills (35398 stars)
- Category: Business
- License: Apache-2.0
- Last updated: 2026-08-31
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill acquiring-disk-image-with-dd-and-dcfldd -g -a claude-code -y`
Codex: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill acquiring-disk-image-with-dd-and-dcfldd -g -a codex -y`
Cursor: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill acquiring-disk-image-with-dd-and-dcfldd -g -a cursor -y`
Gemini CLI: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill acquiring-disk-image-with-dd-and-dcfldd -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills`

## Description

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Acquiring Disk Image with dd and dcfldd

## When to Use
- When you need to create a forensic copy of a suspect drive for investigation
- During incident response when preserving volatile disk evidence before analysis
- When law enforcement or legal proceedings require a verified bit-for-bit copy
- Before performing any destructive analysis on a storage device
- When acquiring images from physical drives, USB devices, or memory cards

## Prerequisites
- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)
- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)
- Write-blocker hardware or software write-blocking configured
- Destination drive with sufficient storage (larger than source)
- Root/sudo privileges on the forensic workstation
- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)

## Workflow

### Step 1: Identify the Target Device and Enable Write Protection

```bash
# List all connected block devices to identify the target
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL

# Verify the device details
fdisk -l /dev/sdb

# Enable software write-blocking (if no hardware blocker)
blockdev --setro /dev/sdb

# Verify read-only status
blockdev --getro /dev/sdb
# Output: 1 (means read-only is enabled)

# Alternatively, use udev rules for persistent write-blocking
echo 'SUBSYSTEM=="block", ATTRS{serial}=="WD-WCAV5H861234", ATTR{ro}="1"' > /etc/udev/rules.d/99-writeblock.rules
udevadm control --reload-rules
```

### Step 2: Prepare the Destination and Document the Source

```bash
# Create case directory structure
mkdir -p /cases/case-2024-001/{images,hashes,logs,notes}

# Document source drive information
hdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt

# Record the serial number and model
smartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt

# Pre-hash the source device
sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt
```

The rest: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/HEAD/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md