Hey everyone welcome to the overview of DCF Ltd and DC 3D.
In this video we covered these command line tools that are specifically designed for digital forensics
in the first part.
We introduce these tools and their background.
Secondly we show the DC 3D usage and its various options.
The CFL DD and DC 3D are enhanced versions of the popular GI and UDD tool DC DD is a fork of DD and
has been developed at the defense computer forensics laboratory while DC 3D is a patched version of
dd developed at the defense cyber crime center.
For those who are not familiar with the D which stands for data dump its an old but very useful tool
that ships with every Linux distribution.
It allows us to make a bit by bit raúl duplicate of the whole media to be acquired.
These two tools have very similar options and both include two major additional features.
Overdye The first is the hashing on the fly of the input data to ensure the integrity of the media to
be acquired.
Second is splitting output to many files or disks.
In this video we're going to explore and use DC 3D because being a patch of Deedy it includes all its
updates and it's still actively developed while DC 3D is based on the outdated version of DC F.L. DD
while DCF Ltd. is based on the outdated version of DCF Ltd and its not actively developed.
Now we could see the usage and options of DC 3D by going to its page on Kalli Linux web site at tools
d'accord slash forensics slash DC 3D.
We can read the package description at the top of the page and below the manual page of the tool which
we can also read by typing hash DC 3 D dash help or man DC 3D D in a terminal at the top of the manual
page.
There's the syntax of the tool.
The options are divided into basic or advanced.
First we'll take a look at the basic options that are important.
The first option.
F stands for input file.
I could take an argument either a device or an image file.
In our case the argument should be a device that represents the disk or partition to be acquired.
Another fundamental option is the O.F. option that stands for output file and take as argument.
Either a device or an image file for our purposes.
The argument should be an image file where all the input data will be copied.
Since we want the output to be hashed to ensure the integrity of the copy we should use the HBO up option
that takes the same arguments as the O.F..
It also calculates the hash of the output and verify it by comparing with the input hash n if we use
this option we must also specify the hashing algorithm which could be for example M.D 5 SHK 1 etc..
If you want to split the output through different files we could also use the US option which take as
arguments the base name of the output files and a format specifier numerical or alphabetical.
With this option we must also specify the max size of each file.
Int the set using both as easy option if you want to see how to specify the empty parameter.
We could see for it at the end of the manual page we could see that we could specify the F.A. by using
a series of zeros ones or Ace respectively.
It could be a numerical value starting 0 by 1 or alphabetical.
We go back to the basic options and we see another interesting option that is the log option.
It takes arguments as a file to store log IO statistics diagnostics and the total hashes of input and
output.
Now we go down to take a look at some of the advanced options that could be interesting for us.
For example the C.A. option.
It takes the number of sectors to read from the input.
I s an and O.D. kit options they take as arguments.
The number of sectors to skip from the start of the input or output respectively.
Awesome.
In this video we've explored the most important options of DC 3D.
After the manual page we showed the DC 3 DD usage example but we're going to dive deeper in the following
video showing how to acquire an image of the fresh drive.