Drive acquisition using DC3DD

The first tool we will use for acquisition is called DC3DD (developed by the department of Defense Cyber Crime Center). DC3DD is a patch of the very popular Data Dump (DD) tool, used for forensic acquisition and hashing.

These are the features of DD:

• Bitstream (raw) disk acquisition and cloning
• Copying disk partitions
• Copying folders and files
• Hard disk drive error checking
• Forensic wiping or forensic and secure deletion of all data on hard disk drives

DC3DD is updated whenever DD updates. DC3DD offers the best of DD with more features, including the following:

• On-the-fly hashing (or hashing done instantly by the tool), using more algorithm choices (MD5, SHA-1, SHA-256, and SHA-512)
• A meter to monitor progress and acquisition time
• Writing of errors to a file
• Splitting of output files
• Verification of files
• Wiping of output files (pattern wiping)

DC3DD must be installed manually in Kali...