November 25, 2008
by Andrew Hoog

dc3dd is forensic imaging tool maintained by the Department of Defense Cyber Crime Center. The utility is a patched version of GNU dd and includes a number of features useful for computer forensics. Many of these features were inspired by dcfldd, but were rewritten for dc3dd.


  • Pattern writes. The program can write a single hexadecimal value or a text string to the output device for wiping purposes.
  • Piecewise and overall hashing with multiple algorithms and variable size windows. Supports MD5, SHA-1, SHA-256, and SHA-512. Hashes can be computed before or after conversions are made.
  • Progress meter with automatic input/output file size probing
  • Combined log for hashes and errors
  • Error grouping. Produces one error message for identical sequential errors
  • Verify mode. Able to repeat any transformations done to the input file and compare it to an output.
  • Ability to split the output into chunks with numerical or alphabetic extensions

See also dcfldd.

Back to the Blog