Drive acquisition using DD
Before we get started using DD, I need to again draw your attention to one of the features of DD, the ability to wipe data, partitions, and drives. Hence, you may find that DD is sometimes fondly referred to as the data destroyer. Be sure to always first identify your devices, partitions, input and output files, and parameters when using DD and DC3DD.
For the exercises in this chapter, I’ll be using an older but functional 2-GB flash drive for the acquisition process using DC3DD.
Should you also wish to use the DD tool, the commands and usage are very much the same.
You may want to first ensure that you can access the dd tool by running dd –-help
. If the dd
command cannot be found, update Kali by running the apt-get update
command, and then run the dd –-help
command again.
Figure 8.19 – dd help options
To perform image acquisition, I’ve used this command:
dd if=/dev/sdb of=produo8g...