acquiring-disk-image-with-dd-and-dcfldd

Pass

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes administrative commands such as blockdev, fdisk, and dd to interact with raw block devices. It also demonstrates modifying system configurations in /etc/udev/rules.d/ to enforce software write-blocking. These actions are necessary for forensic data acquisition and are described within the context of legitimate investigation workflows.
  • [EXTERNAL_DOWNLOADS]: The instructions include installing the dcfldd utility via the system's official package manager (apt-get install). This is a standard and safe method for obtaining software on Linux systems.
Audit Metadata
Risk Level
SAFE
Analyzed
May 14, 2026, 12:17 AM
Security Audit — agent-trust-hub — acquiring-disk-image-with-dd-and-dcfldd