acquiring-disk-image-with-dd-and-dcfldd
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes administrative commands such as
blockdev,fdisk, andddto interact with raw block devices. It also demonstrates modifying system configurations in/etc/udev/rules.d/to enforce software write-blocking. These actions are necessary for forensic data acquisition and are described within the context of legitimate investigation workflows. - [EXTERNAL_DOWNLOADS]: The instructions include installing the
dcflddutility via the system's official package manager (apt-get install). This is a standard and safe method for obtaining software on Linux systems.
Audit Metadata