Today I want to introduce to everyone an excellent command that works very much like dd but it’s just much better…

dcfldd is an enhanced version of dd developed by the U.S. Department of Defense Computer Forensics Lab.

Department of Defense Cyber Crime Center

Features include:

• Hashing on-the-fly, dcfldd can hash the input data as it is being transferred, helping to ensure data integrity. Supports multiple hashes at once
• Progress bar of how much data has already been sent.
• Flexible disk wipes, dcfldd can be used to wipe disks quickly and with a known pattern if desired
• Verification that the image is identical to the original drive, bit-for-bit.
• Split output, dcfldd can split output to multiple files with more configurability than the split command
• Piped output and logs, dcfldd can send all its log data and output to commands as well as files natively
• Verify capability

How to install in Ubuntu:

sudo apt-get install dcfldd

Here you can see a small summary of the most common commands:

if = Input File (device or file you want to read)
of = Output File (device or file you want to copy the data to)
hash = md5, sha1, sha256, sha384 or sha512 (hash type)
hashwindow= Size (in Bytes), about how often a hash calculation will happen
<hash>log = file that will contain the hash calculations log for each hash type (eg: sha1log=sha1.log)
hashconv = valid values: AFTER or BEFORE. It depends if you want to perform the hash after or before the conversion
bs = Byte Size (amount of bytes to read at once)
noerror (ignore read errors and continue) , sync (performs padding) are the 2 most common options here
split = breaks image file into multiple files
splitformat = the file extension format for split operation
conv = convert the file as per the comma separated keyword list (see following list):
ascii=from EBCDIC to ASCII
ebcdic=from ASCII to EBCDIC
ibm=from ASCII to alternated EBCDIC
block=pad newline-terminated records with spaces to cbs-size
unblock=replace trailing spaces in cbs-size records with newline
lcase=change upper case to lower case
notrunc=do not truncate the output file
ucase=change lower case to upper case
swab=swap every pair of input bytes
noerror=continue after read errors
sync=pad every input block with NULs to ibs-size; when used with block or unblock, pad with spaces rather than NULs

Example

dcfldd if=/dev/source hash=md5,sha512 hashwindow=1G md5log=md5.txt sha512log=sha512.txt \
hashconv=after bs=512 conv=noerror,sync split=1G splitformat=aa of=image.dd

This command will read one GB from the source drive and write that to a file called image.dd.aa. It will also calculate the MD5 hash and the sha512 hash of each Gigabyte read.

It will then read the next GB and name that image.dd.ab. The md5 hashes will be stored in a file called md5.txt and the sha512 hashes will be stored in a file called sha512.txt. The block size for transferring has been set to 512 bytes, and in the event of read errors, dcfldd will write zeros.