Showing posts with label Linux ‘dd’. Show all posts
Showing posts with label Linux ‘dd’. Show all posts
Friday, 11 December 2015
Linux ‘dd’
dd comes by default on the majority of Linux distributions available
today (e.g. Ubuntu, Fedora). This tool can be used for various digital
forensic tasks such as forensically wiping a drive (zero-ing out a
drive) and creating a raw image of a drive.
Note: dd is a very powerful tool that can have devastating effects if not used with care. It is recommended that you experiment in a safe environment before using this tool in the real world.
Tip: A modified version of dd is available from http://sourceforge.net/projects/dc3dd/ – dc3dd includes additional features that were added specifically for digital forensic acquisition tasks.
To use dd, simply open a terminal window and type dd followed by a set of command parameters (which command parameters will obviously depend on what you want to do). The basic dd syntax for forensically wiping a drive is:
dd if=/dev/zero of=/dev/sdb1 bs=1024
where if = input file, of = output file, bs = byte size
Note: Replace /dev/sdb1 with the drive name of the drive you want to forensically wipe and 1024 with the size of the byte blocks you want to write out.
The basic dd syntax for creating a forensic image of a drive is:
dd if=/dev/sdb1 of=/home/andrew/newimage.dd bs=512 conv=noerror,sync
where if = input file (or in this case drive), of = output file, bs = byte size, conv = conversion options
Tip: For additional usage info, from a terminal window, type “man dd” without quotes to bring up the help manual for the dd command.
Note: dd is a very powerful tool that can have devastating effects if not used with care. It is recommended that you experiment in a safe environment before using this tool in the real world.
Tip: A modified version of dd is available from http://sourceforge.net/projects/dc3dd/ – dc3dd includes additional features that were added specifically for digital forensic acquisition tasks.
To use dd, simply open a terminal window and type dd followed by a set of command parameters (which command parameters will obviously depend on what you want to do). The basic dd syntax for forensically wiping a drive is:
dd if=/dev/zero of=/dev/sdb1 bs=1024
where if = input file, of = output file, bs = byte size
Note: Replace /dev/sdb1 with the drive name of the drive you want to forensically wipe and 1024 with the size of the byte blocks you want to write out.
The basic dd syntax for creating a forensic image of a drive is:
dd if=/dev/sdb1 of=/home/andrew/newimage.dd bs=512 conv=noerror,sync
where if = input file (or in this case drive), of = output file, bs = byte size, conv = conversion options
Tip: For additional usage info, from a terminal window, type “man dd” without quotes to bring up the help manual for the dd command.
Subscribe to:
Posts (Atom)