dc3dd is forensic imaging tool maintained by the Department of Defense Cyber Crime Center. The utility is a patched version of GNU dd and includes a number of features useful for computer forensics. Many of these features were inspired by dcfldd, but were rewritten for dc3dd.
Features
- Pattern writes. The program can write a single hexadecimal value or a text string to the output device for wiping purposes.
- Piecewise and overall hashing with multiple algorithms and variable size windows. Supports MD5, SHA-1, SHA-256, and SHA-512. Hashes can be computed before or after conversions are made.
- Progress meter with automatic input/output file size probing
- Combined log for hashes and errors
- Error grouping. Produces one error message for identical sequential errors
- Verify mode. Able to repeat any transformations done to the input file and compare it to an output.
- Ability to split the output into chunks with numerical or alphabetic extensions
See also dcfldd.