[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HB69WKP7SS3MF2R34GDD2Q":3,"skill-same:01M6HB69WKP7SS3MF2R34GDD2Q":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6HB69WKP7SS3MF2R34GDD2Q","acquiring-disk-image-with-dd-and-dcfldd",null,"Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Facquiring-disk-image-with-dd-and-dcfldd\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"with","dd","dcfldd","acquiring disk image with dd and dcfldd","image","disk","t1074","for","imaging","de","bit","images","evidence","acquisition","evidence-acquisition","disk-imaging","forensics","verification","create","cybersecurity","2026-11-10 10:12:30",false,"---\nname: acquiring-disk-image-with-dd-and-dcfldd\ndescription: Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- disk-imaging\n- evidence-acquisition\n- dd\n- dcfldd\n- hash-verification\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1006\n- T1005\n- T1025\n- T1074.001\ncategory: acquiring-disk-image-with-dd-and-dcfldd\n---\n# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root\u002Fsudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l \u002Fdev\u002Fsdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro \u002Fdev\u002Fsdb\n\n# Verify read-only status\nblockdev --getro \u002Fdev\u002Fsdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > \u002Fetc\u002Fudev\u002Frules.d\u002F99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002F{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I \u002Fdev\u002Fsdb > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i \u002Fdev\u002Fsdb >> \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Pre-hash the source device\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdd_acquisition.log\n\n# For compressed images to save space\ndd if=\u002Fdev\u002Fsdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Ffirst_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Facquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fverification.txt \\\n   vf=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   verifylog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fverify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fimage_hash.txt\n\n# Compare source and image hashes\ndiff \u003C(sha256sum \u002Fdev\u002Fsdb | awk '{print $1}') \\\n     \u003C(sha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.* | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\ndiff \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt \\\n     \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat \u003C\u003C 'EOF' > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Facquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate\u002FTime: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: \u002Fdev\u002Fsdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware\u002FSoftware model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES\u002FNO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf \u002Fcases\u002Fcase-2024-001\u002Facquisition_package.tar.gz \\\n   \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw\u002Fdd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `\u002Fdev\u002Fsdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=\u002Fdev\u002Fsda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       \u002Fdev\u002Fsdb (500GB Western Digital WD5000AAKX)\n  Destination:  \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n","# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root\u002Fsudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l \u002Fdev\u002Fsdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro \u002Fdev\u002Fsdb\n\n# Verify read-only status\nblockdev --getro \u002Fdev\u002Fsdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > \u002Fetc\u002Fudev\u002Frules.d\u002F99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002F{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I \u002Fdev\u002Fsdb > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i \u002Fdev\u002Fsdb >> \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Pre-hash the source device\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdd_acquisition.log\n\n# For compressed images to save space\ndd if=\u002Fdev\u002Fsdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Ffirst_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Facquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fverification.txt \\\n   vf=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   verifylog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fverify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fimage_hash.txt\n\n# Compare source and image hashes\ndiff \u003C(sha256sum \u002Fdev\u002Fsdb | awk '{print $1}') \\\n     \u003C(sha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.* | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\ndiff \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt \\\n     \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat \u003C\u003C 'EOF' > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Facquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate\u002FTime: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: \u002Fdev\u002Fsdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware\u002FSoftware model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES\u002FNO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf \u002Fcases\u002Fcase-2024-001\u002Facquisition_package.tar.gz \\\n   \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw\u002Fdd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `\u002Fdev\u002Fsdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=\u002Fdev\u002Fsda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       \u002Fdev\u002Fsdb (500GB Western Digital WD5000AAKX)\n  Destination:  \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"category":5,"nist_csf":53,"subdomain":58,"description":7,"mitre_attack":59},[40,39,38,25,26,50],"hash-verification","mahipal","1.0",[54,55,56,57],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[60,61,62,63],"T1006","T1005","T1025","T1074.001","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Facquiring-disk-image-with-dd-and-dcfldd",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill acquiring-disk-image-with-dd-and-dcfldd",{"tool":78,"command":79},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill acquiring-disk-image-with-dd-and-dcfldd",{"tool":81,"command":82},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill acquiring-disk-image-with-dd-and-dcfldd","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Facquiring-disk-image-with-dd-and-dcfldd\u002FSKILL.md",true,[86,91,97],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Facquiring-disk-image-with-dd-and-dcfldd\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2584,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Facquiring-disk-image-with-dd-and-dcfldd\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",6879,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Facquiring-disk-image-with-dd-and-dcfldd\u002Fscripts\u002Fagent.py",[104,130,155,178,194,214],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":113,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[110],{"categoryNo":111,"categoryName":112,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[114,115,116,117,31,118,43,119,41,50,120,121,122,123,124,125,126,127,128,129],"integrity","backup","recovery","validating backup integrity for recovery","testing","validate","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[137,138,139,140,24,43,141,142,143,144,145,146,147,148,149,150,151,152,153,154],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[162,163,127,43,164,165,166,123,124,167,168,169,170,171,172,173,174,175,176,177],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[162,185,186,163,127,24,43,187,165,120,188,189,123,124,190,168,150,191,192,193],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[162,201,202,203,204,205,43,206,207,208,165,209,123,210,211,212,171,213,127,33],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":220,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[221,222,223,224,43,225,226,227,228,229,230,210,231,232,213,233,33,234,235,236],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]