dcfldd

dcfldd was initially developed at Department of Defense Computer Forensics Lab (DCFL). This tool is based on the dd program with additional features tailored for forensic and security use cases. It supports hashing on-the-fly to ensure data integrity during transfers, flexible disk wiping with known patterns, and verification that target drives match input files bit-for-bit.

Key use cases include forensic imaging where data integrity must be verified through hashing, secure disk wiping operations, and splitting large outputs across multiple files with greater configurability than standard tools. dcfldd can output to multiple files or disks simultaneously and send logs to both files and commands natively.

Unlike dd's default 512-byte block size, dcfldd uses 32768 bytes (32 KiB) by default, making it significantly more efficient for large-scale data operations.

dcfldd operates as an enhanced data duplication tool that reads from input sources (files or devices) and writes to output destinations while performing on-the-fly cryptographic hashing of transferred data. It supports multiple simultaneous outputs, split files with configurable formatting, and progress status updates. The tool verifies image integrity by comparing hashes or bit-for-bit matching against specified patterns or files. Additional logging capabilities pipe output and status information to both files and external commands.