Dd - Revision history

Gregfreemyer: /* Tips */

2012-12-17T14:47:47Z

‎Tips

Gregfreemyer: /* Tips */

2012-12-13T17:02:41Z

‎Tips

Jessek: /* See also */ - Added link to mdd

2008-05-22T23:54:11Z

‎See also: - Added link to mdd

ChrFranke: /* See also */ + sg_dd

2008-01-21T22:01:52Z

‎See also: + sg_dd

Jessek: /* See also */ - Added dc3dd

2007-12-19T22:54:23Z

‎See also: - Added dc3dd

Jessek at 16:32, 5 March 2007

2007-03-05T16:32:58Z

Jessek: Revised text

2007-03-05T13:44:18Z

Revised text

Jessek at 16:43, 24 February 2007

2007-02-24T16:43:43Z

Uwe Hermann at 15:58, 6 May 2006

2006-05-06T15:58:41Z

Uwe Hermann at 18:29, 23 April 2006

2006-04-23T18:29:33Z

@@ Line 35: / Line 35: @@
 For imaging a useful alternate invocation in Linux or UNIX is:
-  dd if=/def/hda bs=4K conv=sync,noerror | tee mybigfile.img | md5sum > mybigfile.md5
+  dd if=/dev/hda bs=4K conv=sync,noerror | tee mybigfile.img | md5sum > mybigfile.md5
 The above alternate imaging command uses dd to read the harddrive being imaged and outputs the data to tee.  tee saves a copy of the data as your image file and also outputs a copy of the data to md5sum.  md5sum calculates the hash which gets saved in mybgifile.md5

@@ Line 28: / Line 28: @@
 == Tips ==
-When using dd, be sure to specify a proper "conversion" that will ignore [[bad block]]s. You can also improve imaging performance by specifying a [[blocksize]] that is larger than the default of 512 bytes.
+You can wipe a drive with:
 == Cautions ==

@@ Line 45: / Line 45: @@
 * [[sdd]]
 * [[sg_dd]]
 == External Links ==

@@ Line 44: / Line 44: @@
 * [[ddrescue]]
 * [[sdd]]
 == External Links ==

@@ Line 39: / Line 39: @@
 * [[aimage]]
 * [[Blackbag]]
 * [[dcfldd]]
 * [[dd_rescue]]

@@ Line 8: / Line 8: @@
 }}
-'''dd''', sometimes called '''GNU dd''', is the oldest [[Tools#Disk_Imaging_Tools|imaging tool]] still used. Although it is functional and requires only minimal resources to run, it lacks some of the useful features found in more modern imagers such as [[metadata]] gathering, error correction, piecewise hashing, and a user-friendly interface. dd is a command line program that uses several obscure command line arguments to control the imaging process. Because some of these flags are similar and, if confused, can destroy the source media the examiner is trying to duplicate, users should be careful when running this program. The program generates [[Raw Image File|raw image files]] which can be read by many other programs.
+'''dd''', sometimes called '''GNU dd''', is the oldest [[Tools#Disk_Imaging_Tools|imaging tool]] still used. Although it is functional and requires only minimal resources to run, it lacks some of the useful features found in more modern imagers such as [[metadata]] gathering, error correction, piecewise hashing, and a user-friendly interface. dd is a command line program that uses several obscure command line arguments to control the imaging process. Because some of these flags are similar and, if confused, can destroy the source media the examiner is trying to duplicate, users should be careful when running this program. The program generates [[Raw image file|raw image files]] which can be read by many other programs.
 dd is part of the [[GNU Coreutils]] package which in turn has been ported to many [[Operating system|operating systems]].

@@ Line 8: / Line 8: @@
 }}
-'''dd''', sometimes called '''GNU dd''', is the oldest of the [[Imaging|imaging tools]] currently in use. It is part of the [[coreutils]] package. A command line program that has been ported to many [[operating system]]s, dd uses a complex series of flags to allow the user to image or write data from and to [[raw image file]]s.
+'''dd''', sometimes called '''GNU dd''', is the oldest [[Tools#Disk_Imaging_Tools|imaging tool]] still used. Although it is functional and requires only minimal resources to run, it lacks some of the useful features found in more modern imagers such as [[metadata]] gathering, error correction, piecewise hashing, and a user-friendly interface. dd is a command line program that uses several obscure command line arguments to control the imaging process. Because some of these flags are similar and, if confused, can destroy the source media the examiner is trying to duplicate, users should be careful when running this program. The program generates [[Raw Image File|raw image files]] which can be read by many other programs.
-There are a few forks of dd for forensic purposes including [[dcfldd]], [[sdd]], [[dd_rescue]], [[ddrescue]], [[dccidd]], a [[Windows|Microsoft Windows]] version that supports reading [[physical memory]].
+dd is part of the [[GNU Coreutils]] package which in turn has been ported to many [[Operating system|operating systems]].
 == Example ==
-Here is a common dd command:
+Here are two common dd command lines:
 '''UNIX/Linux'''

@@ Line 2: / Line 2: @@
    name = dd |
    maintainer = [[Paul Rubin]], [[David MacKenzie]], [[Stuart Kemp]] |
-   os = [[Linux]], [[Windows]], [[Mac OS X]] |
+   os = {{Linux}}, {{Windows}}, {{Mac OS X}} |
-   genre = [[Category:Disk imaging]][[:Category:Disk imaging|Disk imaging]] |
+   genre = {{Disk imaging}} |
-   license = [[Category:GPL]][[:Category:GPL|GPL]] |
+   license = {{GPL}} |
    website = [ftp://ftp.gnu.org/gnu/coreutils/ ftp.gnu.org/gnu/coreutils/] |
 }}