Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

eleased as a utility of UNIX. DD is one of the oldest imaging tools and it produces
raw image format.
Table 2.5
List of Example Hardware-based Disk Imaging Tools
Product
Name
Talon® Logicube
HardCopy 3
Data Copy
King
Tableau
TD1
Make Description
Voom
Technology
SalvationData
Guidance
Software
Talon® simultaneously images and verifies data at up to 4
GB/min. The handheld system captures IDE/UDMA/SATA
drives, and can capture SCSI drives via USB cable. Capture
directly from desktop/laptop PCs and MAC computers (via PC
interface) using the Forensic cloning software included with the
Talon.
Duplicate to 1 or 2 destination drives at up to 7.1 GB/min. with no
slow down. Clone entire drive or select Image option to chunk
data into a file or files. Purchase preloaded with MD5 and
SHA256 verification; select 1 or 2 passes. Minimal training
required. Field upgradable.
Access to unstable drives with a lot of bad sectors and copy data
fast. Automatically resets/reboots drives that get stuck to continue
the data duplication process. Sector by sector copy and
synchronous CRC checking.
Disk-to-Disk and Disk-to-File Duplication, Format Disk, Wipe
Disk, Hash Disk (MD5 and SHA-1), HPA/DCO Detection and
Removal, and Blank Disk Check.
Many variants have emerged after DD to fit the purpose of forensic disk imaging.
Apart from DD, some other disk imaging tools are developed based on a proprietary or
open source format. The following sub-sections will discuss some of the popular open
source and proprietary disk imaging tools in details.
2.3.3.1 dcfldd
Disk imaging tool dcfldd is developed and maintained by Nicholas Harbour who used
to work for the Department of Defence Computer Forensics Lab. Dcfldd is an
improved version of GNU dd with elements of digital forensics (Harbour, 2006). One
of the improved features for forensics is hashing on-the-fly which allows hashing the
input data while it is being transferred. Dcfldd can also verify an image to check
whether it is a bit by bit match to the source. It can also split output or output the
image to multiple locations.
31