<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Performing Disk Forensics — API Reference

## Imaging Tools

### dc3dd

```bash
# Basic imaging with SHA-256
dc3dd if=/dev/sdb hof=/evidence/disk.raw hash=sha256 log=/evidence/imaging.log

# Split into 2GB segments
dc3dd if=/dev/sdb hofs=/evidence/disk.raw.000 ofsz=2G hash=sha256

# Wipe target before imaging
dc3dd wipe=/dev/sdc pat=00
```

### dd (standard)

```bash
# Basic image
dd if=/dev/sdb of=/evidence/disk.raw bs=4M status=progress

# Compressed image
dd if=/dev/sdb bs=4M | gzip > /evidence/disk.raw.gz

# With error handling
dd if=/dev/sdb of=/evidence/disk.raw bs=512 conv=noerror,sync
```

## Sleuth Kit Commands

| Command | Purpose | Example |
|---------|---------|---------|
| `mmls` | List partitions | `mmls disk.raw` |
| `fls` | List files/dirs | `fls -r -o 2048 disk.raw` |
| `istat` | File metadata by inode | `istat -o 2048 disk.raw 12345` |
| `icat` | Extract file by inode | `icat -o 2048 disk.raw 12345 > file` |
| `blkls` | Extract unallocated blocks | `blkls -o 2048 disk.raw` |
| `mactime` | Generate timeline from bodyfile | `mactime -b bodyfile.txt` |
| `sigfind` | Find file signatures | `sigfind -o 2048 0x4d5a disk.raw` |
| `img_stat` | Image file information | `img_stat disk.raw` |
| `fsstat` | Filesystem details | `fsstat -o 2048 disk.raw` |

### fls Options

```bash
-r    # Recursive listing
-d    # Deleted entries only
-u    # Undeleted entries only
-m "/"  # Output in mactime bodyfile format
-o N  # Partition offset in sectors
-l    # Long listing (details)
```

## Eric Zimmerman Tools

### MFTECmd

```bash
MFTECmd.exe -f '$MFT' --csv /output/ --csvf mft.csv
MFTECmd.exe -f '$J' --csv /output/ --csvf usn.csv    # USN Journal
MFTECmd.exe -f '$LogFile' --csv /output/ --csvf logfile.csv
```

### PECmd (Prefetch)

```bash
PECmd.exe -d C:\Windows\Prefetch\ --csv /output/ --csvf prefetch.csv
PECmd.exe -f PROGRAM.EXE-HASH.pf --json /output/
```

### RECmd (Registry)

```bash
RECmd.exe --bn BatchExamples/AllRegExecKeys.reb -d /registry/ --csv /output/
RECmd.exe -f NTUSER.DAT --sk "Software\Microsoft\Windows\CurrentVersion\Run"
```

## Mount Commands

```bash
# Read-only mount with offset
mount -o ro,loop,offset=$((512*2048)) disk.raw /mnt/evidence

# Mount E01 with ewfmount
ewfmount disk.E01 /mnt/ewf
mount -o ro /mnt/ewf/ewf1 /mnt/evidence

# Software write-block
blockdev --setro /dev/sdb
```

## Common Patterns

### Full Disk Analysis Workflow

```
1. Image disk with dc3dd (hash verification)
2. mmls — identify partitions
3. fls -r — enumerate all files
4. fls -r -d — find deleted files
5. fls -r -m "/" | mactime — build timeline
6. Extract suspicious files with icat
7. Parse MFT, Prefetch, Amcache, Registry
8. Carve unallocated space
```

### Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `offset` | Partition start in sectors | `2048` |
| `inode` | File system inode number | `12345` |
| `hash` | Hashing algorithm | `sha256` |
| `bs` | Block size for dd | `4M` |
| `format` | Image format | `raw`, `E01`, `AFF4` |
