1

dcfldd is often recommended in forensics to duplicate hard drives. One of the reasons dcfldd is preferred over dd is the on-the-fly hashing feature.

Q: can I really rely on this feature to ensure the integrity of my copy since the hashing is performed on data in memory and not the data written on disk?

  • 2
    From the download page: Hashing on-the-fly - dcfldd can hash the input data as it is being transferred, helping to ensure data integrity. They only claim that it helps, not guarantees. – Neil Smithline Sep 19 '15 at 16:18
  • So if i understand correctly after performing the copy, i must perform hashing on the image and compare it to the output given by the dcfldd utility to ensure its integrity? – Othman Sep 19 '15 at 16:47
1

If you create and verify the hash, it will detect errors that occurred on the write option. As you point out, read errors can't be detected as they will have occurred before the hash.

According to the ShoeStringForensics blog, you can verify the copy with:

dcfldd if=/dev/sdb1 vf=/media/disk/test_image.dd verifylog=/media/disk/verifylog.txt

You should redo the copy if the hash check fails.

  • Thank you. I was thinking about doing something like this to duplicate the hard drive and check its integrity. sudo dcfldd if=/dev/sdb of=usb.img bs=3M hash=sha256 hashlog=sha256.txt; sha256sum usb.img – Othman Sep 19 '15 at 17:30
  • That seems right – Neil Smithline Sep 20 '15 at 3:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.