dcfldd is often recommended in forensics to duplicate hard drives. One of the reasons
dcfldd is preferred over
dd is the on-the-fly hashing feature.
Q: can I really rely on this feature to ensure the integrity of my copy since the hashing is performed on data in memory and not the data written on disk?