Adquirindo Imagem de Disco com dd e dcfldd

Quando Usar

• Quando você precisa criar uma cópia forense de um disco suspeito para investigação
• Durante a resposta a incidentes, ao preservar evidências voláteis do disco antes da análise
• Quando a aplicação da lei ou processos legais exigem uma cópia verificada bit a bit
• Antes de realizar qualquer análise destrutiva em um dispositivo de armazenamento
• Ao adquirir imagens de discos físicos, dispositivos USB ou cartões de memória

Pré-requisitos

• Estação de trabalho forense baseada em Linux (SIFT, Kali ou qualquer distribuição Linux)
• dd (pré-instalado em todos os sistemas Linux) ou dcfldd (versão forense aprimorada)
• Hardware de bloqueio de escrita ou bloqueio de escrita por software configurado
• Disco de destino com armazenamento suficiente (maior que a origem)
• Privilégios de root/sudo na estação de trabalho forense
• Utilitários de hashing SHA-256 ou MD5 (sha256sum, md5sum)

Fluxo de Trabalho

Passo 1: Identificar o Dispositivo de Destino e Habilitar Proteção Contra Escrita

# List all connected block devices to identify the target
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL

# Verify the device details
fdisk -l /dev/sdb

# Enable software write-blocking (if no hardware blocker)
blockdev --setro /dev/sdb

# Verify read-only status
blockdev --getro /dev/sdb
# Output: 1 (means read-only is enabled)

# Alternatively, use udev rules for persistent write-blocking
echo 'SUBSYSTEM=="block", ATTRS{serial}=="WD-WCAV5H861234", ATTR{ro}="1"' > /etc/udev/rules.d/99-writeblock.rules
udevadm control --reload-rules

Passo 2: Preparar o Destino e Documentar a Origem

# Create case directory structure
mkdir -p /cases/case-2024-001/{images,hashes,logs,notes}

# Document source drive information
hdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt

# Record the serial number and model
smartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt

# Pre-hash the source device
sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt

Passo 3: Adquirir a Imagem Usando dd

# Basic dd acquisition with progress and error handling
dd if=/dev/sdb of=/cases/case-2024-001/images/evidence.dd \
   bs=4096 \
   conv=noerror,sync \
   status=progress 2>&1 | tee /cases/case-2024-001/logs/dd_acquisition.log

# For compressed images to save space
dd if=/dev/sdb bs=4096 conv=noerror,sync status=progress | \
   gzip -c > /cases/case-2024-001/images/evidence.dd.gz

# Using dd with a specific count for partial acquisition
dd if=/dev/sdb of=/cases/case-2024-001/images/first_1gb.dd \
   bs=1M count=1024 status=progress

Passo 4: Adquirir Usando dcfldd (Método Forense Preferencial)

# Install dcfldd if not present
apt-get install dcfldd

# Acquire image with built-in hashing and split output
dcfldd if=/dev/sdb \
   of=/cases/case-2024-001/images/evidence.dd \
   hash=sha256,md5 \
   hashwindow=1G \
   hashlog=/cases/case-2024-001/hashes/acquisition_hashes.txt \
   bs=4096 \
   conv=noerror,sync \
   errlog=/cases/case-2024-001/logs/dcfldd_errors.log

# Split large images into manageable segments
dcfldd if=/dev/sdb \
   of=/cases/case-2024-001/images/evidence.dd \
   hash=sha256 \
   hashlog=/cases/case-2024-001/hashes/split_hashes.txt \
   bs=4096 \
   split=2G \
   splitformat=aa

# Acquire with verification pass
dcfldd if=/dev/sdb \
   of=/cases/case-2024-001/images/evidence.dd \
   hash=sha256 \
   hashlog=/cases/case-2024-001/hashes/verification.txt \
   vf=/cases/case-2024-001/images/evidence.dd \
   verifylog=/cases/case-2024-001/logs/verify.log

Passo 5: Verificar a Integridade da Imagem

# Hash the acquired image
sha256sum /cases/case-2024-001/images/evidence.dd | \
   tee /cases/case-2024-001/hashes/image_hash.txt

# Compare source and image hashes
diff <(sha256sum /dev/sdb | awk '{print $1}') \
     <(sha256sum /cases/case-2024-001/images/evidence.dd | awk '{print $1}')

# If using split images, verify each segment
sha256sum /cases/case-2024-001/images/evidence.dd.* | \
   tee /cases/case-2024-001/hashes/split_image_hashes.txt

# Re-hash source to confirm no changes occurred
sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_after.txt
diff /cases/case-2024-001/hashes/source_hash_before.txt \
     /cases/case-2024-001/hashes/source_hash_after.txt

Passo 6: Documentar o Processo de Aquisição

# Gerar relatório de aquisição
cat << 'EOF' > /cases/case-2024-001/notes/acquisition_report.txt
RELATÓRIO DE AQUISIÇÃO DE IMAGEM DE DISCO
=======================================
Número do Caso: 2024-001

…