---
# System prepended metadata

title: dd

---

# dd


| dd | dc3dd | dcfldd |
| -------- | -------- | -------- |
| stands for “data dump”, creates a bit-by-bit copy of a physical drive     | will be updated every time GNU dd is updated, **features** includes ==Highlights include hashing on-the-fly, split output files, pattern writing, a progress meter, and file verification== | has its own release schedule, **features** includes ==Hashing on-the-fly, Status output, Flexible disk wipes, Image/wipe Verify, Multiple outputs, Split output, Piped output and logs==   |


    
## dd usage example:

```
dd if=/dev/sdb of=sdb_image.img bs=65536 conv=noerror,sync
```
![](https://i.imgur.com/iklUxdu.png)
http://www.cyber-forensics.ch/acquiring-data-with-dd-dcfldd-dc3dd/

## dc3dd usage example:

```
dc3dd if=/dev/sdb1 of=/evidence/image.dd bs=4k hash=sha256 hashlog=hash.log log=image.log progress=on
```
![](https://i.imgur.com/p6mlHWK.png)
https://www.forensics-matters.com/2020/10/20/simple-forensics-imaging-with-dd-dc3dd-dcfldd/


## dcfldd usage example:

```
dcfldd if=/dev/sdb1 conv=sync,noerror hash=sha256 hashlog=hash.log of=/evidence/image.dd
```
![](https://i.imgur.com/01eMvEC.png)
https://www.forensics-matters.com/2020/10/20/simple-forensics-imaging-with-dd-dc3dd-dcfldd/