# dd | dd | dc3dd | dcfldd | | -------- | -------- | -------- | | stands for “data dump”, creates a bit-by-bit copy of a physical drive | will be updated every time GNU dd is updated, **features** includes ==Highlights include hashing on-the-fly, split output files, pattern writing, a progress meter, and file verification== | has its own release schedule, **features** includes ==Hashing on-the-fly, Status output, Flexible disk wipes, Image/wipe Verify, Multiple outputs, Split output, Piped output and logs== | ## dd usage example: ``` dd if=/dev/sdb of=sdb_image.img bs=65536 conv=noerror,sync ``` ![](https://i.imgur.com/iklUxdu.png) http://www.cyber-forensics.ch/acquiring-data-with-dd-dcfldd-dc3dd/ ## dc3dd usage example: ``` dc3dd if=/dev/sdb1 of=/evidence/image.dd bs=4k hash=sha256 hashlog=hash.log log=image.log progress=on ``` ![](https://i.imgur.com/p6mlHWK.png) https://www.forensics-matters.com/2020/10/20/simple-forensics-imaging-with-dd-dc3dd-dcfldd/ ## dcfldd usage example: ``` dcfldd if=/dev/sdb1 conv=sync,noerror hash=sha256 hashlog=hash.log of=/evidence/image.dd ``` ![](https://i.imgur.com/01eMvEC.png) https://www.forensics-matters.com/2020/10/20/simple-forensics-imaging-with-dd-dc3dd-dcfldd/