dcfldd is often recommended in forensics to duplicate hard drives. One of the reasons dcfldd is preferred over dd is the on-the-fly hashing feature.

Q: can I really rely on this feature to ensure the integrity of my copy since the hashing is performed on data in memory and not the data written on disk?

  • 2
    From the download page: Hashing on-the-fly - dcfldd can hash the input data as it is being transferred, helping to ensure data integrity. They only claim that it helps, not guarantees. Sep 19, 2015 at 16:18
  • So if i understand correctly after performing the copy, i must perform hashing on the image and compare it to the output given by the dcfldd utility to ensure its integrity?
    – Othman
    Sep 19, 2015 at 16:47

1 Answer 1


If you create and verify the hash, it will detect errors that occurred on the write option. As you point out, read errors can't be detected as they will have occurred before the hash.

According to the ShoeStringForensics blog, you can verify the copy with:

dcfldd if=/dev/sdb1 vf=/media/disk/test_image.dd verifylog=/media/disk/verifylog.txt

You should redo the copy if the hash check fails.

  • Thank you. I was thinking about doing something like this to duplicate the hard drive and check its integrity. sudo dcfldd if=/dev/sdb of=usb.img bs=3M hash=sha256 hashlog=sha256.txt; sha256sum usb.img
    – Othman
    Sep 19, 2015 at 17:30
  • 1
    That seems right Sep 20, 2015 at 3:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .