[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESHBWXSYGD355CZCYDF5Q4":3,"skill-same:01M6ESHBWXSYGD355CZCYDF5Q4":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6ESHBWXSYGD355CZCYDF5Q4","acquiring-disk-image-with-dd-and-dcfldd",null,"Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Facquiring-disk-image-with-dd-and-dcfldd\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"with","dd","dcfldd","acquiring disk image with dd and dcfldd","image","disk","t1074","imaging","de","bit","images","evidence","acquisition","integrity","evidence-acquisition","disk-imaging","forensics","verification","create","cybersecurity","2026-11-10 10:12:30",false,"---\nname: acquiring-disk-image-with-dd-and-dcfldd\ndescription: Create forensically sound bit-for-bit disk images using dd and dcfldd\n  while preserving evidence integrity through hash verification.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- disk-imaging\n- evidence-acquisition\n- dd\n- dcfldd\n- hash-verification\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1006\n- T1005\n- T1025\n- T1074.001\n---\n\n# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root\u002Fsudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l \u002Fdev\u002Fsdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro \u002Fdev\u002Fsdb\n\n# Verify read-only status\nblockdev --getro \u002Fdev\u002Fsdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > \u002Fetc\u002Fudev\u002Frules.d\u002F99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002F{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I \u002Fdev\u002Fsdb > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i \u002Fdev\u002Fsdb >> \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Pre-hash the source device\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdd_acquisition.log\n\n# For compressed images to save space\ndd if=\u002Fdev\u002Fsdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Ffirst_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Facquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fverification.txt \\\n   vf=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   verifylog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fverify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fimage_hash.txt\n\n# Compare source and image hashes\ndiff \u003C(sha256sum \u002Fdev\u002Fsdb | awk '{print $1}') \\\n     \u003C(sha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.* | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\ndiff \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt \\\n     \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat \u003C\u003C 'EOF' > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Facquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate\u002FTime: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: \u002Fdev\u002Fsdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware\u002FSoftware model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES\u002FNO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf \u002Fcases\u002Fcase-2024-001\u002Facquisition_package.tar.gz \\\n   \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw\u002Fdd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `\u002Fdev\u002Fsdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=\u002Fdev\u002Fsda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       \u002Fdev\u002Fsdb (500GB Western Digital WD5000AAKX)\n  Destination:  \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n","# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root\u002Fsudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l \u002Fdev\u002Fsdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro \u002Fdev\u002Fsdb\n\n# Verify read-only status\nblockdev --getro \u002Fdev\u002Fsdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > \u002Fetc\u002Fudev\u002Frules.d\u002F99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002F{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I \u002Fdev\u002Fsdb > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i \u002Fdev\u002Fsdb >> \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Pre-hash the source device\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdd_acquisition.log\n\n# For compressed images to save space\ndd if=\u002Fdev\u002Fsdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Ffirst_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Facquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fverification.txt \\\n   vf=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   verifylog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fverify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fimage_hash.txt\n\n# Compare source and image hashes\ndiff \u003C(sha256sum \u002Fdev\u002Fsdb | awk '{print $1}') \\\n     \u003C(sha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.* | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\ndiff \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt \\\n     \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat \u003C\u003C 'EOF' > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Facquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate\u002FTime: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: \u002Fdev\u002Fsdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware\u002FSoftware model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES\u002FNO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf \u002Fcases\u002Fcase-2024-001\u002Facquisition_package.tar.gz \\\n   \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw\u002Fdd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `\u002Fdev\u002Fsdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=\u002Fdev\u002Fsda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       \u002Fdev\u002Fsdb (500GB Western Digital WD5000AAKX)\n  Destination:  \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n",{"name":5,"tags":52,"author":54,"domain":46,"license":15,"version":55,"nist_csf":56,"subdomain":61,"description":7,"mitre_attack":62},[43,42,41,28,29,53],"hash-verification","mahipal","1.0",[57,58,59,60],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[63,64,65,66],"T1006","T1005","T1025","T1074.001","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Facquiring-disk-image-with-dd-and-dcfldd","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill acquiring-disk-image-with-dd-and-dcfldd",{"tool":81,"command":82},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill acquiring-disk-image-with-dd-and-dcfldd",{"tool":84,"command":85},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill acquiring-disk-image-with-dd-and-dcfldd","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Facquiring-disk-image-with-dd-and-dcfldd\u002FSKILL.md",true,[89,94,100],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Facquiring-disk-image-with-dd-and-dcfldd\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",2584,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Facquiring-disk-image-with-dd-and-dcfldd\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",6879,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Facquiring-disk-image-with-dd-and-dcfldd\u002Fscripts\u002Fagent.py",[107,146,155,164,186,212],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":128,"publishedAt":47},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[114,117,120,123],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[109,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,37,144,145,27],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","files","youtube",{"skillNo":147,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":154,"publishedAt":47},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[150,151,152,153],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},[109,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,37,144,145,27],{"skillNo":156,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":163,"publishedAt":47},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[159,160,161,162],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},[109,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,37,144,145,27],{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":47},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[171,172,173,174,175,176,177,178,179,180,181,182,183,184,185],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":47},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[192],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,197,198,199,200,201,202,203,204,140,141,205,206,207,208,209,210,211],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":228,"publishedAt":47},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[218,221,224,225],{"categoryNo":219,"categoryName":220,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":222,"categoryName":223,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":226,"categoryName":227,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000036","内容创作者",[229,230,231,232,233,234,235,236,137,237,140,141,142,238,239,240,241,242,185,243],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]