[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EJ6XEPVCVA2RXTCSYYJE6":3,"skill-same:01M71EJ6XEPVCVA2RXTCSYYJE6":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":14,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M71EJ6XEPVCVA2RXTCSYYJE6","forensics-disk-acquisition-dcfldd-forensic",null,"Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fforensics\u002Fdisk\u002Facquisition\u002Fdcfldd\u002Fforensic\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"acquisition","forensics disk acquisition dcfldd forensic","forensic","forensics","dcfldd","disk","for","evidence","sonnet","digital-forensics","integrity","read","de","imaging","verification","create","Bash","cybersecurity","bit","images","2026-11-10 10:12:30",false,"---\nname: forensics-disk-acquisition-dcfldd-forensic\ndescription: Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- disk-imaging\n- evidence-acquisition\n- dd\n- dcfldd\n- hash-verification\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root\u002Fsudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l \u002Fdev\u002Fsdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro \u002Fdev\u002Fsdb\n\n# Verify read-only status\nblockdev --getro \u002Fdev\u002Fsdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > \u002Fetc\u002Fudev\u002Frules.d\u002F99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002F{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I \u002Fdev\u002Fsdb > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i \u002Fdev\u002Fsdb >> \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Pre-hash the source device\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdd_acquisition.log\n\n# For compressed images to save space\ndd if=\u002Fdev\u002Fsdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Ffirst_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Facquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fverification.txt \\\n   vf=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   verifylog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fverify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fimage_hash.txt\n\n# Compare source and image hashes\ndiff \u003C(sha256sum \u002Fdev\u002Fsdb | awk '{print $1}') \\\n     \u003C(sha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.* | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\ndiff \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt \\\n     \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat \u003C\u003C 'EOF' > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Facquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate\u002FTime: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: \u002Fdev\u002Fsdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware\u002FSoftware model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES\u002FNO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf \u002Fcases\u002Fcase-2024-001\u002Facquisition_package.tar.gz \\\n   \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw\u002Fdd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `\u002Fdev\u002Fsdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=\u002Fdev\u002Fsda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       \u002Fdev\u002Fsdb (500GB Western Digital WD5000AAKX)\n  Destination:  \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n","# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root\u002Fsudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l \u002Fdev\u002Fsdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro \u002Fdev\u002Fsdb\n\n# Verify read-only status\nblockdev --getro \u002Fdev\u002Fsdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > \u002Fetc\u002Fudev\u002Frules.d\u002F99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002F{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I \u002Fdev\u002Fsdb > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i \u002Fdev\u002Fsdb >> \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Fsource_drive_info.txt\n\n# Pre-hash the source device\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdd_acquisition.log\n\n# For compressed images to save space\ndd if=\u002Fdev\u002Fsdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=\u002Fdev\u002Fsdb of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Ffirst_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Facquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fdcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=\u002Fdev\u002Fsdb \\\n   of=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   hash=sha256 \\\n   hashlog=\u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fverification.txt \\\n   vf=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   verifylog=\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fverify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fimage_hash.txt\n\n# Compare source and image hashes\ndiff \u003C(sha256sum \u002Fdev\u002Fsdb | awk '{print $1}') \\\n     \u003C(sha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd.* | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsplit_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum \u002Fdev\u002Fsdb | tee \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\ndiff \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_before.txt \\\n     \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002Fsource_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat \u003C\u003C 'EOF' > \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002Facquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate\u002FTime: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: \u002Fdev\u002Fsdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware\u002FSoftware model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES\u002FNO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf \u002Fcases\u002Fcase-2024-001\u002Facquisition_package.tar.gz \\\n   \u002Fcases\u002Fcase-2024-001\u002Fhashes\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fnotes\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw\u002Fdd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `\u002Fdev\u002Fsdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=\u002Fdev\u002Fsda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       \u002Fdev\u002Fsdb (500GB Western Digital WD5000AAKX)\n  Destination:  \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n",{"name":5,"tags":44,"capec":49,"model":27,"tools":50,"domain":36,"maxTurns":54,"nist_csf":55,"subdomain":28,"description":7},[22,45,46,47,23,48],"disk-imaging","evidence-acquisition","dd","hash-verification",[],[51,35,52,53],"Read","Glob","Grep",20,[56,57,58,59],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux\u002Fforensics\u002Fdisk\u002Facquisition\u002Fdcfldd\u002Fforensic","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill forensics-disk-acquisition-dcfldd-forensic",{"tool":73,"command":74},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill forensics-disk-acquisition-dcfldd-forensic",{"tool":76,"command":77},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill forensics-disk-acquisition-dcfldd-forensic","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fforensics\u002Fdisk\u002Facquisition\u002Fdcfldd\u002Fforensic\u002FSKILL.md",true,[81],{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"index.json","REFERENCE","参考文档",669,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fforensics\u002Fdisk\u002Facquisition\u002Fdcfldd\u002Fforensic\u002Findex.json",[88,111,132,152,174,190],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[95,96,97,98,99,31,100,101,102,103,104,105,106,107,108,109,22,36,110],"services","detect","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","process-forensics",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[118,95,119,98,120,121,122,36,35,123,124,125,126,127,31,128,129,30,130,131],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[139,140,141,142,143,144,36,35,145,123,146,147,31,30,148,149,28,150,151,27],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","windows-registry","regripper",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[96,159,160,161,162,163,164,100,165,36,110,166,167,168,169,170,171,172,173,31],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[181,182,96,183,161,163,184,100,185,165,36,110,123,186,187,188,189,173,31,101],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":196,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[197,96,161,198,184,100,199,200,36,110,201,202,203,204,205,206,31,101,207,208],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]