Skip to content
Get packs

Forensic Disk Imaging with dd/dcfldd

Makes the agent create verified, bit-for-bit disk images of drives for forensic investigations on Linux.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent follows a structured forensic workflow for copying a storage device (hard drive, USB stick, or memory card) bit by bit into an image file using the standard Linux tools dd and dcfldd. It guides setting the device to read-only, documenting the source drive, computing SHA-256 or MD5 hashes before and after acquisition to prove the copy is unaltered, and writing an acquisition report and chain-of-custody notes. It also includes a Python helper script that wraps some of these steps (listing devices, checking and enabling write protection, computing hashes).

Great for

  • Digital forensics students learning evidence acquisition procedures
  • Incident responders who need a documented, hash-verified copy of a drive before analysis
  • Security engineers building or testing forensic imaging workflows on a lab workstation

Skip it if

  • Production evidence handling without a trained examiner, since legal admissibility depends on procedures and hardware write-blockers the skill only partly covers and cannot verify on its own
  • Systems where you do not have root access or the correct device, because wrong device names in dd commands can overwrite data (dd can destroy the wrong disk if the target is misidentified)

Try asking

  • “Create a verified bit-for-bit image of /dev/sdb for case 2024-001 with SHA-256 hashing”
  • “Set up a case folder structure and document the serial number and model of a suspect USB drive”
  • “Compare source and image hashes after acquisition and produce an acquisition report”
  • “Split a large disk image into 2G segments and hash each segment”
Step-by-step guide: how to use Forensic Disk Imaging with dd/dcflddInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    acquiring-disk-image-with-dd-and-dcfldd.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip acquiring-disk-image-with-dd-and-dcfldd.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip acquiring-disk-image-with-dd-and-dcfldd.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Verify the target device with lsblk and fdisk before running any dd or dcfldd command; the wrong device name can destroy data.
  • Enable a hardware write-blocker when possible, and confirm read-only status before imaging.
  • Test the workflow on a spare drive or loop device first, and review the Python script before letting the agent run it as root.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.