dcfldd was initially developed at Department of Defense Computer Forensics
Lab (DCFL). This tool is based on the dd program with the following additional
features:
.
- Hashing on-the-fly: dcfldd can hash the input data as it is being
transferred, helping to ensure data integrity.
- Status output: dcfldd can update the user of its progress in terms of the
amount of data transferred and how much longer operation will take.
- Flexible disk wipes: dcfldd can be used to wipe disks quickly and with a
known pattern if desired.
- Image/wipe verify: dcfldd can verify that a target drive is a bit-for-bit
match of the specified input file or pattern.
- Multiple outputs: dcfldd can output to multiple files or disks at the same
time.
- Split output: dcfldd can split output to multiple files with more
configurability than the split command.
- Piped output and logs: dcfldd can send all its log data and output to
commands as well as files natively.
- When dd uses a default block size (bs, ibs, obs) of 512 bytes, dcfldd uses
32768 bytes (32 KiB) which is HUGELY more efficient.
- The following options are present in dcfldd but not in dd: ALGORITHMlog:,
errlog, hash, hashconv, hashformat, hashlog, hashlog:, hashwindow, limit,
of:, pattern, sizeprobe, split, splitformat, statusinterval, textpattern,
totalhashformat, verifylog, verifylog:, vf.
