DD for DFIR

< 1 min read

  1. Creating a forensic image of a disk or partition:
sudo dd if=/dev/sda of=/path/to/output/image bs=4M

This command will create a forensic image of the entire /dev/sda disk, using a block size of 4 megabytes. The resulting image can be analyzed for evidence.

  1. Extracting a raw image of a specific partition:
sudo dd if=/dev/sda2 of=/path/to/output/image bs=4M

This command will create a forensic image of the /dev/sda2 partition, using a block size of 4 megabytes.

  1. Extracting a raw image of a specific file:
sudo dd if=/path/to/input/file of=/path/to/output/image bs=4M

This command will create a forensic image of the file at /path/to/input/file, using a block size of 4 megabytes. This can be useful for extracting a specific file from a disk image.

  1. Extracting a raw image of a specific sector range:
sudo dd if=/dev/sda of=/path/to/output/image bs=512 count=100 skip=300

Powered by BetterDocs

Leave a Reply