enhanced version of dd for forensics and security


dcfldd was initially developed at Department of Defense Computer Forensics Lab (DCFL). This tool is based on the dd program with the following additional features:

 - Hashing on-the-fly: dcfldd can hash the input data as it is being
   transferred, helping to ensure data integrity.
 - Status output: dcfldd can update the user of its progress in terms of the
   amount of data transferred and how much longer operation will take.
 - Flexible disk wipes: dcfldd can be used to wipe disks quickly and with a
   known pattern if desired.
 - Image/wipe verify: dcfldd can verify that a target drive is a bit-for-bit
   match of the specified input file or pattern.
 - Multiple outputs: dcfldd can output to multiple files or disks at the same
 - Split output: dcfldd can split output to multiple files with more
   configurability than the split command.
 - Piped output and logs: dcfldd can send all its log data and output to
   commands as well as files natively.
 - When dd uses a default block size (bs, ibs, obs) of 512 bytes, dcfldd uses
   32768 bytes (32 KiB) which is HUGELY more efficient.
 - The following options are present in dcfldd but not in dd: ALGORITHMlog:,
   errlog, hash, hashconv, hashformat, hashlog, hashlog:, hashwindow, limit,
   of:, pattern, sizeprobe, split, splitformat, statusinterval, textpattern,
   totalhashformat, verifylog, verifylog:, vf.

Upload more screenshots

Please help extend the collection of screenshots. Just make a screenshot and upload it here. You don't need to register or anything.

Upload a screenshot

Hint: upload an image here from your clipboard with Ctrl-V



Install this software package

If the package is available for the distribution you are currently using on your computer then install the software by clicking on…

Install dcfldd