The dd command should be familiar to any examiner who has done traditional hard drive forensics. dd is a Linux command-line utility used by definition to convert and copy files, but is frequently used in forensics to create bit-by-bit images of entire drives. Many variations of dd also exist and are commonly used, such as dcfldd, dc3dd, ddrescue, and dccidd. As dd is built for Linux-based systems, it is frequently included on Android platforms. This means that a method for creating an image of the device often already exists on the device!
The dd command has many options that can be set; only the forensically important options are going to be covered in the following list. A full list of command options can be found at http://man7.org/linux/man-pages/man1/dd.1.html. The format of the dd command is as follows:
dd if=/dev/block/mmcblk0 of=/sdcard...
