• Tutorial: How to use dcfldd instead of dd

    Today I want to introduce to everyone an excellent command that works very much like dd but it’s just much better…

    dcfldd is an enhanced version of dd developed by the U.S. Department of Defense Computer Forensics Lab.

     Department of Defense Cyber Crime Center

    Department of Defense Cyber Crime Center

    Features include:

    • Hashing on-the-fly, dcfldd can hash the input data as it is being transferred, helping to ensure data integrity. Supports multiple hashes at once
    • Progress bar of how much data has already been sent.
    • Flexible disk wipes, dcfldd can be used to wipe disks quickly and with a known pattern if desired
    • Verification that the image is identical to the original drive, bit-for-bit.
    • Split output, dcfldd can split output to multiple files with more configurability than the split command
    • Piped output and logs, dcfldd can send all its log data and output to commands as well as files natively
    • Verify capability

    How to install in Ubuntu:

    sudo apt-get install dcfldd

    Here you can see a small summary of the most common commands:

    if = Input File (device or file you want to read)
    of = Output File (device or file you want to copy the data to)
    hash = md5, sha1, sha256, sha384 or sha512 (hash type)
    hashwindow= Size (in Bytes), about how often a hash calculation will happen
    <hash>log = file that will contain the hash calculations log for each hash type (eg: sha1log=sha1.log)
    hashconv = valid values: AFTER or BEFORE. It depends if you want to perform the hash after or before the conversion
    bs = Byte Size (amount of bytes to read at once)
    noerror (ignore read errors and continue) , sync (performs padding) are the 2 most common options here
    split = breaks image file into multiple files
    splitformat = the file extension format for split operation
    conv = convert the file as per the comma separated keyword list (see following list):
    ascii=from EBCDIC to ASCII
    ebcdic=from ASCII to EBCDIC
    ibm=from ASCII to alternated EBCDIC
    block=pad newline-terminated records with spaces to cbs-size
    unblock=replace trailing spaces in cbs-size records with newline
    lcase=change upper case to lower case
    notrunc=do not truncate the output file
    ucase=change lower case to upper case
    swab=swap every pair of input bytes
    noerror=continue after read errors
    sync=pad every input block with NULs to ibs-size; when used with block or unblock, pad with spaces rather than NULs

    Example

    dcfldd if=/dev/source hash=md5,sha512 hashwindow=1G md5log=md5.txt sha512log=sha512.txt \
    hashconv=after bs=512 conv=noerror,sync split=1G splitformat=aa of=image.dd

    This command will read one GB from the source drive and write that to a file called image.dd.aa. It will also calculate the MD5 hash and the sha512 hash of each Gigabyte read.

    It will then read the next GB and name that image.dd.ab. The md5 hashes will be stored in a file called md5.txt and the sha512 hashes will be stored in a file called sha512.txt. The block size for transferring has been set to 512 bytes, and in the event of read errors, dcfldd will write zeros.

    Incoming search terms:

    • dcfldd
    • dcfldd example
  • How to: copy the text of a Windows message box in the clipboard

    Paper & Pen

    Ever had the need to copy the text of a message box into the clipboard to send it to somebody via email, chat or maybe your favourite ticket management tool?

    If the answer is yes and you’ve always copied manually the text or taken a screenshot, maybe it will be interesting for you to know that there is a faster/better way to do it: CTRL+C

    Yes, if you press CTRL+C on the message box window the box title, text and even button text will be copied to the clipboard…

    Let’s see an example with the sample message box below:

    Sample Error Message Box

    Now make sure your window is active and press CTRL+C. If you now open a notepad and paste (CTRL+V) the content of the clipboard you’ll see:

    —————————
    – Test Box –
    —————————
    This is a test

    message box
    —————————
    OK
    —————————

    As you can see, the text is divided in three sections (separated by “—————————”) where the first one is the title, the second one is the message itself and the last one is the button content.

    I’m sure that this little tip will be very useful for you at some point… Support life is filled with message boxes and error messages that must be copied in search engines, knowledge bases, ticket tools…