Communitygithub.com

SamuelChien/mega-skills-collection

使用 dd 和 dcfldd 创建具备取证可靠性的逐位磁盘映像，并通过哈希验证保证证据完整性。

mega-skills-collection 是什么？

该技能指导用户使用 dd 和 dcfldd 工具在 Linux 取证工作站上创建逐位（bit-for-bit）的磁盘映像，适用于数字取证、事件响应、法律调查等场景。技能涵盖了从设备识别、写保护启用、映像获取、哈希验证到案件文档记录的全流程。它详细说明了如何利用 dcfldd 的内置哈希和分段输出功能，以及如何通过 sha256sum 和 md5sum 比对源盘与映像的哈希值来验证完整性。此外，技能还支持硬件/软件写保护配置、压缩映像、部分获取和网络远程获取等高级场景，确保整个取证过程符合可追溯性与证据保管链要求。对于需要处理存储设备证据的取证分析师、安全工程师和执法人员而言，这是一个高度实用且完整的工具。

兼容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/SamuelChien/mega-skills-collection/tree/HEAD/acquiring-disk-image-with-dd-and-dcfldd
查看原文→浏览所有技能

在你喜欢的 AI 中提问

打开一个已预加载此 Agent Skill 的新对话。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

文档

使用 dd 和 dcfldd 获取磁盘映像

适用场景

  • 需要对嫌疑驱动器创建取证副本以供调查时
  • 事件响应过程中，需在分析前保留易失性磁盘证据时
  • 法律或司法程序要求提供经过验证的逐位副本时
  • 对存储设备进行破坏性分析之前
  • 从物理驱动器、USB 设备或存储卡获取映像时

前提条件

  • 基于 Linux 的取证工作站（SIFT、Kali 或任何 Linux 发行版）
  • dd（所有 Linux 系统预装）或 dcfldd（增强的取证版）
  • 已配置硬件写保护器或软件写保护
  • 目标驱动器有足够的存储空间（大于源驱动器）
  • 在取证工作站上拥有 root/sudo 权限
  • SHA-256 或 MD5 哈希工具（sha256sum、md5sum）

工作流程

步骤 1：识别目标设备并启用写保护

# 列出所有连接的块设备以识别目标
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL

# 验证设备详细信息
fdisk -l /dev/sdb

# 启用软件写保护（如果没有硬件写保护器）
blockdev --setro /dev/sdb

# 验证只读状态
blockdev --getro /dev/sdb
# 输出：1（表示已启用只读）

# 也可以使用 udev 规则实现持久写保护
echo 'SUBSYSTEM=="block", ATTRS{serial}=="WD-WCAV5H861234", ATTR{ro}="1"' > /etc/udev/rules.d/99-writeblock.rules
udevadm control --reload-rules

步骤 2：准备目标目录并记录源信息

# 创建案例目录结构
mkdir -p /cases/case-2024-001/{images,hashes,logs,notes}

# 记录源驱动器信息
hdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt

# 记录序列号和型号
smartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt

# 预计算源设备哈希值
sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt

步骤 3：使用 dd 获取映像

# 基本 dd 获取，包含进度和错误处理
dd if=/dev/sdb of=/cases/case-2024-001/images/evidence.dd \
   bs=4096 \
   conv=noerror,sync \
   status=progress 2>&1 | tee /cases/case-2024-001/logs/dd_acquisition.log

# 压缩映像以节省空间
dd if=/dev/sdb bs=4096 conv=noerror,sync status=progress | \
   gzip -c > /cases/case-2024-001/images/evidence.dd.gz

# 使用 dd 指定数量进行部分获取
dd if=/dev/sdb of=/cases/case-2024-001/images/first_1gb.dd \
   bs=1M count=1024 status=progress

步骤 4：使用 dcfldd 获取（首选取证方法）

# 如果未安装 dcfldd，先安装
apt-get install dcfldd

# 使用内置哈希和分片输出获取映像
dcfldd if=/dev/sdb \
   of=/cases/case-2024-001/images/evidence.dd \
   hash=sha256,md5 \
   hashwindow=1G \
   hashlog=/cases/case-2024-001/hashes/acquisition_hashes.txt \
   bs=4096 \
   conv=noerror,sync \
   errlog=/cases/case-2024-001/logs/dcfldd_errors.log

# 将大型映像拆分为易于管理的片段
dcfldd if=/dev/sdb \
   of=/cases/case-2024-001/images/evidence.dd \
   hash=sha256 \
   hashlog=/cases/case-2024-001/hashes/split_hashes.txt \
   bs=4096 \
   split=2G \
   splitformat=aa

# 带验证环节的获取
dcfldd if=/dev/sdb \
   of=/cases/case-2024-001/images/evidence.dd \
   hash=sha256 \
   hashlog=/cases/case-2024-001/hashes/verification.txt \
   vf=/cases/case-2024-001/images/evidence.dd \
   verifylog=/cases/case-2024-001/logs/verify.log

步骤 5：验证映像完整性

# 计算已获取映像的哈希值
sha256sum /cases/case-2024-001/images/evidence.dd | \
   tee /cases/case-2024-001/hashes/image_hash.txt

# 比对源和映像的哈希值
diff <(sha256sum /dev/sdb | awk '{print $1}') \
     <(sha256sum /cases/case-2024-001/images/evidence.dd | awk '{print $1}')

# 如果使用了分片映像，验证每个片段
sha256sum /cases/case-2024-001/images/evidence.dd.* | \
   tee /cases/case-2024-001/hashes/split_image_hashes.txt

# 重新计算源哈希，确认没有发生更改
sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_after.txt
diff /cases/case-2024-001/hashes/source_hash_before.txt \
     /cases/case-2024-001/hashes/source_hash_after.txt

步骤 6：记录获取过程

# 生成获取报告
cat << 'EOF' > /cases/case-2024-001/notes/acquisition_report.txt
DISK IMAGE ACQUISITION REPORT
==============================
Case Number: 2024-001
Date/Time: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
Examiner: [Name]

Source Device: /dev/sdb
Model: [from hdparm output]
Serial: [from hdparm output]
Size: [from fdisk output]

Acquisition Tool: dcfldd v1.9.1
Block Size: 4096
Write Blocker: [Hardware/Software model]

Image File: evidence.dd
Image Hash (SHA-256): [from hash file]
Source Hash (SHA-256): [from hash file]
Hash Match: YES/NO

Errors During Acquisition: [from error log]
EOF

# 将日志打包归档
tar -czf /cases/case-2024-001/acquisition_package.tar.gz \
   /cases/case-2024-001/hashes/ \
   /cases/case-2024-001/logs/ \
   /cases/case-2024-001/notes/

关键概念

概念描述
逐位复制包含未分配空间和闲置空间的源设备精确副本
写保护器防止向证据介质写入数据的硬件或软件机制
哈希验证比较源和映像的加密哈希以证明完整性
块大小（bs）影响传输速度的块大小；取证中通常为 4096 或 64K
conv=noerror,sync遇到读取错误时继续，并用零填充以保持偏移对齐
保管链证明证据未被篡改的文档记录轨迹
分片映像将大型映像拆分为更小的文件，便于存储和传输
Raw/dd 格式逐位映像格式，无元数据容器开销

工具与系统

工具用途
dd标准 Unix 磁盘复制工具，用于原始映像
dcflddDoD 计算机取证实验室增强版 dd，带哈希功能
dc3dd另一个来自 DoD 网络犯罪中心的取证 dd 变体
sha256sumSHA-256 哈希计算，用于完整性验证
blockdev用于设置块设备只读模式的 Linux 命令
hdparm驱动器识别和参数报告
smartctlS.M.A.R.T. 数据检索，用于驱动器健康和识别
lsblk块设备枚举和识别

常见场景

场景 1：获取嫌疑笔记本电脑硬盘 通过 Tableau T35u 硬件写保护器连接驱动器，识别为 /dev/sdb，使用 dcfldd 配合 SHA-256 哈希，拆分为 4GB 片段以便刻录 DVD 存档，验证哈希匹配，在案例笔记中记录。

场景 2：对受感染工作站的 USB 闪存驱动器进行成像 使用 blockdev --setro 软件写保护，使用 dcfldd 包含 MD5 和 SHA-256 双哈希获取，映像足够小可存储为单个文件，验证后存储在加密案例驱动器上。

场景 3：通过网络远程获取 使用通过 netcat 或 ssh 管道传输的 dd 进行远程获取：ssh root@remote "dd if=/dev/sda bs=4096" | dd of=remote_image.dd bs=4096，两端独立哈希以验证传输完整性。

场景 4：从故障驱动器获取 首先使用 ddrescue 恢复可读取扇区，然后使用带 conv=noerror,sync 的 dd 用零填充间隙，在错误日志中记录哪些扇区无法读取。

输出格式

获取摘要：
  源设备：      /dev/sdb (500GB Western Digital WD5000AAKX)
  目标文件：    /cases/case-2024-001/images/evidence.dd
  工具：        dcfldd 1.9.1
  块大小：     4096 字节
  耗时：       2h 15m 32s
  复制字节数：  500,107,862,016
  错误：       0 个坏扇区
  源 SHA-256：  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1
  映像 SHA-256： a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1
  验证结果：    通过 - 哈希匹配

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

SamuelChien/mega-skills-collection

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

SamuelChien/mega-skills-collection

Arquitecto de Soluciones Principal y Consultor Tecnológico de Andru.ia. Diagnostica y traza la hoja de ruta óptima para proyectos de IA en español.

SamuelChien/mega-skills-collection

Ingeniero de Sistemas de Andru.ia. Diseña, redacta y despliega nuevas habilidades (skills) dentro del repositorio siguiendo el Estándar de Diamante.

SamuelChien/mega-skills-collection

Estratega de Inteligencia de Dominio de Andru.ia. Analiza el nicho específico de un proyecto para inyectar conocimientos, regulaciones y estándares únicos del sector. Actívalo tras definir el nicho.

SamuelChien/mega-skills-collection

2D game development principles. Sprites, tilemaps, physics, camera.

SamuelChien/mega-skills-collection

3D game development principles. Rendering, shaders, physics, cameras.

SamuelChien/mega-skills-collection

Expert in building 3D experiences for the web - Three.js, React Three Fiber, Spline, WebGL, and interactive 3D scenes. Covers product configurators, 3D portfolios, immersive websites, and bringing depth to web experiences.

SamuelChien/mega-skills-collection

Accessibility audit skill for scanning, fixing, and verifying WCAG 2.2 Level A and AA compliance across React, Next.js, Vue, Angular, Svelte, and plain HTML codebases. Use when auditing accessibility, fixing a11y violations, checking color contrast, generating compliance reports, or integrating accessibility checks into CI/CD pipelines.

SamuelChien/mega-skills-collection

Ab Test Analyzer - Auto-activating skill for Data Analytics. Triggers on: ab test analyzer, ab test analyzer Part of the Data Analytics skill category.

SamuelChien/mega-skills-collection

A B Test Config Creator - Auto-activating skill for ML Deployment. Triggers on: a b test config creator, a b test config creator Part of the ML Deployment skill category.

SamuelChien/mega-skills-collection

When the user wants to plan, design, or implement an A/B test or experiment. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "conversion experiment," "statistical significance," or "test this." For tracking implementation, see analytics-tracking.

SamuelChien/mega-skills-collection

Acceptance Criteria Creator - Auto-activating skill for Enterprise Workflows. Triggers on: acceptance criteria creator, acceptance criteria creator Part of the Enterprise Workflows skill category.

SamuelChien/mega-skills-collection

Use when a coding task should be driven end-to-end from issue intake through implementation, review, deployment, and acceptance verification with minimal human re-intervention.

SamuelChien/mega-skills-collection

Accessibility Audit Runner - Auto-activating skill for Frontend Development. Triggers on: accessibility audit runner, accessibility audit runner Part of the Frontend Development skill category.

SamuelChien/mega-skills-collection

You are an accessibility expert specializing in WCAG compliance, inclusive design, and assistive technology compatibility. Conduct audits, identify barriers, and provide remediation guidance.

SamuelChien/mega-skills-collection

Web accessibility patterns for WCAG 2.2 compliance including ARIA, keyboard navigation, screen readers, and testing

SamuelChien/mega-skills-collection

Manage Discord channel access — approve pairings, edit allowlists, set DM/group policy. Use when the user asks to pair, approve someone, check who's allowed, or change policy for the Discord channel.

SamuelChien/mega-skills-collection

Create unified specification packages across Business, Development, and Design teams. Staged elaboration (L0 Vision → L1 Requirements → L2 Team Detail → L3 Acceptance Criteria) to build shared understanding. Does not write code.

SamuelChien/mega-skills-collection

Research a company or person and get actionable sales intel. Works standalone with web search, supercharged when you connect enrichment tools or your CRM. Trigger with "research [company]", "look up [person]", "intel on [prospect]", "who is [name] at [company]", or "tell me about [company]".

SamuelChien/mega-skills-collection

Validate messaging consistency across website, GitHub repos, and local documentation generating read-only discrepancy reports. Use when checking content alignment or finding mixed messaging. Trigger with phrases like "check consistency", "validate documentation", or "audit messaging".

相关技能

steipete/sag

ElevenLabs text-to-speech with mac-style say UX.

community

steipete/oracle

Oracle CLI second-model review/debug/refactor/design with selected files, dry-run token checks, API or browser engine.

community

steipete/peekaboo

Capture and automate macOS UI with the Peekaboo CLI.

community

mattpocock/design-an-interface

Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".

community

mattpocock/prototype

Build a throwaway prototype to flesh out a design — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route.

community

mattpocock/grill-me

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

community