Guide · Agent skill
How to use the dd/dcfldd disk imaging agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This agent skill teaches an AI agent a structured workflow for copying a hard drive, USB stick or memory card bit by bit into an image file on a Linux forensic workstation, using the standard tools dd and dcfldd. It is aimed at digital forensics students, incident responders and security engineers who need a documented, hash-verified copy before analysis. After this guide you will know how to install the skill, ask for it in plain language, and what safety limits to respect.
Forensic Disk Imaging with dd/dcflddmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. Or upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
- 2Prepare the workstation. Confirm you have a Linux forensic workstation, root or sudo access, dcfldd installed with apt-get, and a destination drive larger than the source.
- 3Ask for the imaging task. Describe the device, the case and the goal in plain language, for example that you want a hash-verified image of a USB stick.
- 4Identify and set read-only. Use lsblk to confirm the device, then set it read-only with blockdev --setro and check it with blockdev --getro.
- 5Hash and acquire. The agent hashes the source, then creates the image with dcfldd and hash logging, or with dd where you request it.
- 6Verify and document. Compare the image hash with the source hash, re-hash the source to confirm no change, and save the acquisition report and logs with the case files.
What is an agent skill and what does this one make the agent do?
An agent skill is a folder of instructions and optional scripts that an AI agent loads when a request matches the skill's description. This skill's main file, SKILL.md, describes the imaging workflow in steps, and the skill also includes a reference file on dd and dcfldd options and a Python helper, scripts/agent.py.
When the skill is active, the agent follows a forensic procedure: it sets the source device to read-only, documents the drive, computes SHA-256 or MD5 hashes before and after acquisition, creates the image, verifies it, and writes an acquisition report with chain-of-custody notes.
- Identifies the target device and enables write protection
- Records drive details and hashes the source before copying
- Acquires the image with dd or dcfldd
- Verifies the image and re-hashes the source to confirm it did not change
- Writes an acquisition report and archives the logs
How do you install the dd/dcfldd disk imaging skill?
Download the skill ZIP from this page and unzip it into one of two locations. For a personal setup, use ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.
If you use the Claude apps instead, upload the ZIP under Settings → Capabilities → Skills.
- Personal: unzip into ~/.claude/skills/
- Project only: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
What do you need installed before using it?
The skill is written for a Linux forensic workstation such as SIFT, Kali, or any Linux distribution. You need root or sudo privileges. dd is normally preinstalled. dcfldd is installed with apt-get, as the source shows.
The skill's requirements also list sha256sum, md5sum, hdparm, smartctl, lsblk, fdisk, blockdev and udevadm, plus Python 3 for scripts/agent.py. A write blocker, hardware or software, is recommended.
- Linux forensic workstation with root or sudo
- dd and dcfldd (install dcfldd with apt-get install dcfldd)
- sha256sum, md5sum, hdparm, smartctl, lsblk, fdisk, blockdev, udevadm
- Python 3 for scripts/agent.py
- Destination drive larger than the source
apt-get install dcflddHow do you trigger the skill with a natural request?
Describe the job in plain terms and mention the device and goal. The skill's description covers imaging a suspect drive, USB device or memory card, preserving disk evidence during incident response, and producing a verified copy for legal or law-enforcement work before destructive analysis.
Be specific about the device and your case. The agent is more likely to pick the right workflow if you say what you are imaging and why.
- "Image /dev/sdb to a verified evidence.dd file for case 2024-001 with SHA-256 hashes."
- "I need a hash-verified copy of this USB stick before I analyse it."
- "Set this suspect drive to read-only and document its serial number before imaging."
What does a typical acquisition look like?
The workflow starts by listing devices and setting the source to read-only. blockdev --getro prints 1 when read-only is enabled. The agent then hashes the source, creates the image with dcfldd (which the source calls the preferred forensic method because it has built-in hashing), and re-hashes the source to confirm nothing changed.
Before any command runs against a real drive, confirm the device name with lsblk. A wrong device name can overwrite data.
- Set read-only and check it
- Record drive details with hdparm and smartctl
- Hash the source before and after acquisition
- Compare the image hash with the source hash
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL
blockdev --setro /dev/sdb
blockdev --getro /dev/sdbWhat safety limits should you know about?
The skill runs scripts (scripts/agent.py) and needs root privileges, so review what it will run before granting access. The skill does not use the network. The source does include a remote example that pipes dd over ssh; treat that as a separate, advanced task.
The skill does not make evidence legally admissible. Its own description says legal admissibility depends on procedures and hardware write-blockers that the skill only partly covers. Production evidence should be handled by a trained examiner.
- Wrong device names in dd commands can destroy data on the wrong disk
- Scripts run with the privileges you give the agent
- No network use according to the skill's listing
- Hardware write-blockers are recommended; the skill cannot verify them
What people use it for
- Imaging a suspect laptop drive for a case file, with SHA-256 hashes logged before and after acquisition
- Making a small verified image of a USB flash drive from a compromised workstation, using software write-blocking
- Practising evidence acquisition procedures on a lab workstation as a digital forensics student
- Building or testing a repeatable imaging workflow for an incident response team
Frequently asked questions
Is the dd/dcfldd disk imaging skill free to use?
The skill is licensed under Apache-2.0, as listed on this page. dd is a standard Linux tool, and dcfldd is installed with apt-get. Check the licence file in the skill itself for the full terms.
What do I need to run the dd/dcfldd skill?
You need a Linux forensic workstation, root or sudo privileges, dd and dcfldd, and the hashing and disk utilities listed on this page. Python 3 is needed for scripts/agent.py, and a write blocker is recommended.
How do I install dcfldd?
Run apt-get install dcfldd on your Linux workstation. dd is usually preinstalled on Linux systems, so you normally only need to add dcfldd.
Where do I put the skill files?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
Can this skill make an image admissible in court?
Not on its own. The skill's description says legal admissibility depends on procedures and hardware write-blockers that it only partly covers and cannot verify. Work with a trained examiner for production evidence.
What is the difference between dd and dcfldd?
dd is the standard Unix duplication tool used for raw imaging. dcfldd is an enhanced version from the DoD Computer Forensics Laboratory that adds built-in hashing and split output, which is why the source prefers it for forensic work.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits forensics students, incident responders and security engineers who want a documented, hash-verified imaging workflow on a Linux lab or response workstation. It is not suited to production evidence handling without a trained examiner and proper write-blocking, or to systems where you cannot confirm the correct device, since a wrong dd target can destroy data. If you need a tool that handles legal chain of custody end to end, pick a dedicated forensic suite, and consider dc3dd, which the source lists as another forensic dd variant.
Download the skill