Enhanced version of dd for forensics and security
dcfldd [OPTION]...
Copy a file, converting and formatting according to the options.
bs=BYTES
force ibs=BYTES and obs=BYTES
cbs=BYTES
convert BYTES bytes at a time
conv=KEYWORDS
convert the file as per the comma separated keyword list
count=BLOCKS
copy only BLOCKS input blocks
ibs=BYTES
read BYTES bytes at a time
if=FILE
read from FILE instead of stdin
obs=BYTES
write BYTES bytes at a time
of=FILE
write to FILE instead of stdout
NOTE: of=FILE may be used several times to write
output to multiple files simultaneously
of:=COMMAND
exec and write output to process COMMAND
seek=BLOCKS
skip BLOCKS obs-sized blocks at start of output
skip=BLOCKS
skip BLOCKS ibs-sized blocks at start of input
pattern=HEX
use the specified binary pattern as input
textpattern=TEXT
use repeating TEXT as input
errlog=FILE
send error messages to FILE as well as stderr
hashwindow=BYTES
perform a hash on every BYTES amount of data
hash=NAME
either md5, sha1, sha256, sha384 or sha512
default algorithm is md5. To select multiple algorithms to run simultaneously enter the names in a comma separated list
hashlog=FILE
send MD5 hash output to FILE instead of stderr
if you are using multiple hash algorithms you can send each to a separate file using the convention ALGORITHMlog=FILE, for example md5log=FILE1, sha1log=FILE2, etc.
hashlog:=COMMAND
exec and write hashlog to process COMMAND
ALGORITHMlog:=COMMAND also works in the same fashion
hashconv=[before|after]
perform the hashing before or after the conversions
hashformat=FORMAT
display each hashwindow according to FORMAT
the hash format mini-language is described below
totalhashformat=FORMAT
display the total hash value according to FORMAT
status=[on|off]
display a continual status message on stderr
default state is "on"
statusinterval=N
update the status message every N blocks
default value is 256
sizeprobe=[if|of]
determine the size of the input or output file
for use with status messages. (this option gives you a percentage indicator) WARNING: do not use this option against a
tape device.
split=BYTES
write every BYTES amount of data to a new file
This operation applies to any of=FILE that follows
splitformat=TEXT
the file extension format for split operation.
you may use any number of 'a' or 'n' in any combo the default format is "nnn" NOTE: The split and splitformat options take effect
only for output files specified AFTER these options appear in the command line. Likewise, you may specify these several times for for different output files within the same command line. you may use as many digits in any combination you would like. (e.g. "anaannnaana" would be valid, but quite insane)
vf=FILE
verify that FILE matches the specified input
verifylog=FILE
send verify results to FILE instead of stderr
verifylog:=COMMAND
exec and write verify results to process COMMAND
--help
display this help and exit
--version
output version information and exit
The structure of of FORMAT may contain any valid text and special variables. The built-in variables are used the following format: #variable_name# To pass FORMAT strings to the program from a command line, it may be necessary to surround your FORMAT strings with "quotes." The built-in variables are listed below:
window_start
The beginning byte offset of the hashwindow
window_end
The ending byte offset of the hashwindow
block_start
The beginning block (by input blocksize) of the window
block_end
The ending block (by input blocksize) of the hash window
hash
The hash value
algorithm
The name of the hash algorithm
hashformat="#window_start# - #window_end#: #hash#" totalhashformat="Total (#algorithm#): #hash#"
\n
Newline
\t
Tab
\r
Carriage return
\\
Insert the '\' character
##
Insert the '#' character as text, not a variable
BLOCKS and BYTES may be followed by the following multiplicative suffixes: xM M, c 1, w 2, b 512, kD 1000, k 1024, MD 1,000,000, M 1,048,576, GD 1,000,000,000, G 1,073,741,824, and so on for T, P, E, Z, Y. Each KEYWORD may be:
ascii
from EBCDIC to ASCII
ebcdic
from ASCII to EBCDIC
ibm
from ASCII to alternated EBCDIC
block
pad newline-terminated records with spaces to cbs-size
unblock
replace trailing spaces in cbs-size records with newline
lcase
change upper case to lower case
notrunc
do not truncate the output file
ucase
change lower case to upper case
swab
swap every pair of input bytes
noerror
continue after read errors
sync
pad every input block with NULs to ibs-size; when used with block or unblock, pad with spaces rather than NULs
Written by: dcfldd by Nicholas Harbour, GNU dd by Paul Rubin, David MacKenzie and Stuart Kemp.
Report bugs to <[email protected]>.
Copyright © 1985-2006 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.