adulau / dcfldd

dcfldd - enhanced version of dd for forensics and security

dcfldd

dcfldd is a modified version of GNU dd. The major features added are hashing, fast disk wiping (through patterns) and status output.

dcfldd was originally created by Nicholas Harbour from the DoD Computer Forensics Laboratory (DCFL). Nick Harbour still maintains the package, although he is no longer affiliated with the DCFL.

Send any feature requests or ideas to the author at [email protected].

dcfldd on GitHub

On https://github.com/adulau/dcfldd/, this is the latest version of http://dcfldd.sourceforge.net/ (1.3.4-1) including Debian patches and some additional patches from Alexandre Dulaunoy https://github.com/adulau.

dcfldd usage

dcfldd if=/dev/sda hash=md5,sha256 hashwindow=20G md5log=md5.txt sha256log=sha256.txt \
       hashconv=after bs=512 conv=noerror,sync split=20G splitformat=aa of=sda.dd

dcfldd's Issues

segfault when using errlog argument

dcfldd if=/dev/zero of=test.raw bs=1 count=512 errlog=error.log
512 blocks (0Mb) written.
512+0 records in
Segmentation fault (core dumped)

Known issues

1. Data becomes misaligned when a faulty sector is encountered on a source drive. NIST report, upstream patch.

2. An infinite loop when a faulty sector is encountered on a source drive (data is written to an output file until there is no space left). I observed this bug in dcfldd long ago (2014), I can't identify the buggy piece of code (it's hard to reproduce). Possibly related to the previous bug.