acquiring-disk-image-with-dd-and-dcfldd
mukul975/Anthropic-Cybersecurity-Skills / skills/acquiring-disk-image-with-dd-and-dcfldd
makes a bit-for-bit copy verified by hash , which improves: keeps evidence intact for your case files
Details
- judge’s score
- 8/10
- place
- outside the packs
- publisher
- mukul975
- status
- new
- pinned commit
- 54a7988 on GitHub (new tab)
- skill’s last commit
- Aug 2, 2026
- repo stars
- 34,752
- main type
- Other
Judgement
Precise triggers and concrete commands. Average value, most of it being standard dd documentation. Flaws: quoted heredoc that does not expand $(date), example output with identical hashes, scripts annex not assessed.
reservations
- The acquisition report uses a quoted heredoc ('EOF'), so $(date) will not be evaluated: the template is broken.
- Example outputs show identical source and image hashes and "PASSED": misleading presentation if copied as is.
- scripts/agent.py is mentioned but not provided; it could not be examined, which limits the overall assessment.
- Triggering
- 2/2
- Added value
- 1/2
- Precision
- 2/2
- Scope
- 2/2
- Quality
- 1/2
Alerts
2 alerts, by category
Destruction
- high risk
Root commands and writing of udev rules modifying /etc without prior checks; to be run with caution on the wrong device (e.g. /dev/sda).
Static scan
- info risk
bundled scripts, not run by the SKILL.md
scripts/agent.py
Original description
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence…
added on Oct 19, 2026 · license Apache-2.0