<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Acquiring Disk Images

## dc3dd (DoD Cyber Crime Center dd)

**Forensic variant of dd with built-in hashing and logging.**

```bash
# Basic acquisition with dual hashing
dc3dd if=/dev/sdb of=evidence.dd hash=sha256 hash=md5 log=acq.log

# Split into 2GB segments
dc3dd if=/dev/sdb ofsz=2G of=evidence.dd hash=sha256 log=acq.log

# Wipe verification (zero-fill then hash)
dc3dd wipe=/dev/sdb hash=sha256 log=wipe.log
```

| Parameter | Description |
|-----------|-------------|
| `if=` | Input file / device |
| `of=` | Output file |
| `ofsz=` | Split output file size |
| `hash=` | Hash algorithm (sha256, md5, sha1) |
| `log=` | Log file path |
| `hlog=` | Hash log file path |
| `rec=off` | Disable error recovery (strict mode) |

## ewfacquire (libewf)

**Acquire Expert Witness Format (E01) images.**

```bash
ewfacquire /dev/sdb \
  -t evidence \
  -C "Case-2026-001" \
  -D "Device description" \
  -e "Examiner" \
  -E "Agency" \
  -c deflate \
  -S 2G \
  -u
```

| Flag | Description |
|------|-------------|
| `-t` | Target base filename (no extension) |
| `-C` | Case number |
| `-D` | Description |
| `-e` | Examiner name |
| `-E` | Evidence number |
| `-c` | Compression (none, deflate, bzip2) |
| `-S` | Segment file size |
| `-u` | Unattended mode |

## ewfverify

```bash
ewfverify evidence.E01
```

Returns exit code 0 if stored hashes match computed hashes.

## Sleuth Kit — mmls

**Display partition layout of a disk image.**

```bash
mmls evidence.dd
mmls -t dos evidence.dd    # Force DOS partition table
mmls -t gpt evidence.dd    # Force GPT partition table
```

Output columns: `Slot | Start | End | Length | Description`

## blockdev (Write Blocking)

```bash
# Enable software write block
sudo blockdev --setro /dev/sdb

# Verify write block
blockdev --getro /dev/sdb    # Returns: 1

# Remove write block (after imaging)
sudo blockdev --setrw /dev/sdb
```

## guymager (GUI Acquisition)

```bash
sudo guymager &
```

Supports E01, AFF, and dd formats with GUI-based case metadata entry.
Provides real-time hash verification and acquisition speed monitoring.

## Hash Verification Commands

```bash
# SHA-256
sha256sum evidence.dd > evidence.sha256
sha256sum -c evidence.sha256

# MD5
md5sum evidence.dd > evidence.md5
md5sum -c evidence.md5

# Compare source device to image
sha256sum /dev/sdb > source.sha256
diff source.sha256 evidence.sha256
```
