dcfldd - Latest version 1.3.4-1

Quick Links

Download dcfldd
GNU Coreutils manual on dd
Sourceforge project page - Home to dcfldd development and feature requests

Introduction

dcfldd is an enhanced version of GNU dd with features useful for forensics and security. Based on the dd program found in the GNU Coreutils package, dcfldd has the following additional features:

Hashing on-the-fly - dcfldd can hash the input data as it is being transferred, helping to ensure data integrity.
Status output - dcfldd can update the user of its progress in terms of the amount of data transferred and how much longer operation will take.
Flexible disk wipes - dcfldd can be used to wipe disks quickly and with a known pattern if desired.
Image/wipe Verify - dcfldd can verify that a target drive is a bit-for-bit match of the specified input file or pattern.
Multiple outputs - dcfldd can output to multiple files or disks at the same time.
Split output - dcfldd can split output to multiple files with more configurability than the split command.
Piped output and logs - dcfldd can send all its log data and output to commands as well as files natively.

About dd

From the GNU Coreutils manual on dd:

dd copies a file (from standard input to standard output, by default) with a changeable I/O block size, while optionally performing conversions on it.

In practice, dd is often used to create bit-stream image files of media as part of a forensic acquisition process. dd is both powerful and flexible, but has a somewhat complex command line interface. The GNU Coreutils manual on dd describes the command line syntax. You may also want to read Sam Chessman's article on dd from Linux Journal.

Download

Stable Version

The latest stable version of dcfldd is version 1.3.4-1 and was released on 19 Dec 2006. Changes in the latest version:

Fixed an issue with error-producing blocks not being zero padding under BSD systems.

Version 1.3.4-1

19 Dec 2006

source code

MD5 952026c872f11b53ce0ec6681a3eef0a

Beta Version

There is no beta version of dcfldd right now. If you have any problems or would like to see something added to dcfldd, please send mail to the developer at nickharbour [at] gmail [dot] com or visit the Sourceforge project page .

Older Versions

Older versions of dcfldd are available for historical purposes. Unless you have a truly compelling reason, you shouldn't use these.

Version	Date	Format	MD5
Version 1.3.4	12 Feb 2006	source code	33df7c8be205117295899840fe89b0d5
		i386 RPM	14b8020832196ce3f084fb398e0b8980
		Source RPM	b83d7d229a5560b55e1440960e8f7a6b
		Windows Binary	4b447c7fb4ed513154c9af70297fb206
1.3.3	24 Jan 2006	source code	5a47e9c12ef9caaf65d7522a2e5c6373
1.3-RC2	19 May 2005	source code	f6a7b198931a419852682f143f6f5ed4
1.2.4	9 May 2005	source code	429a0df4d6a6bf35b8be3f3204b98f0c
1.2.3-2	13 May 2005	Windows binary	307258c140d82d1f9192ae3f31e5e8d6
1.2.3-2	13 May 2005	source code	d4c74b2bdb2a1075d71740f53cd09e88
1.2.3	9 May 2005	source code	41e87f7508c560d4332af7e7f36aa930
1.2.2	3 May 2005	source code	1c820fef9c94f8373a93682c65548121
1.2.1	30 April 2005	source code	bf78322614febe54765194cbe7c2a49f
1.2	24 April 2005	source code	653f11b42eeaa3b705e6e58b34f93bc2
1.0	15 March 2002	source code	d32e4dd88840c1851bbd15f401ce7c45

About the developer

dcfldd was written by Nicholas Harbour, who at the time was working for the Department of Defense Computer Forensics Lab (DCFL). Although he is no longer affiliated with the DCFL, Nick still maintains the package. The DCFL does not maintain, support, or have any other affiliation with dcfldd.

Nick Harbour is a Ninja.

Please send all correspondence regarding dcfldd to Nick Harbour at nickharbour [at] gmail [dot] com.

Acknowledgements

The developer wishes to thank, in no particular order,
Jesse Kornblum - For the web page, testing, support and sushi.
The folks from the RCFLs who contributed the RPM package specfile.
Eric Jackson, Sig Murphy, Steve Uder, Jason Upchurch, Mary Shriner, Jason Luttgens, William Salusky, Blare Sutton and Bret Padres.

This page was last updated on