このページの2つのバージョン間の差分を表示します。
両方とも前のリビジョン 前のリビジョン | |||
forensics:dd [2012/08/14 08:02] kikuzou |
forensics:dd [2012/08/14 08:16] kikuzou |
||
---|---|---|---|
行 23: | 行 23: | ||
> dd if=\\.\e: of=usb.dd conv=noerror bs=512 --localwrt | > dd if=\\.\e: of=usb.dd conv=noerror bs=512 --localwrt | ||
</ | </ | ||
+ | |||
+ | |||
+ | ==== Usage ==== | ||
+ | < | ||
+ | Usage: dd if=[SOURCE] of=[DESTINATION] [OPTIONS] | ||
+ | |||
+ | Copy a device or one or more files or streams, converting and formatting | ||
+ | according to the options specified: | ||
+ | |||
+ | bs=[BYTES] | ||
+ | conv=[KEYWORDS] | ||
+ | | ||
+ | |||
+ | noerror | ||
+ | comp | ||
+ | decomp | ||
+ | swab Swap each pair of bytes. | ||
+ | notrunc | ||
+ | resume | ||
+ | level only). | ||
+ | |||
+ | count=[BLOCKS] | ||
+ | ibs=[BYTES] | ||
+ | if=[SOURCE] | ||
+ | obs=[BYTES] | ||
+ | of=[DESTINATION] Specifies the destination for output; the default is stdout. | ||
+ | seek=[BLOCKS] | ||
+ | skip=[BLOCKS] | ||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | If --iport or --lport are specified, the OUTPUT_FILE specified with the | ||
+ | ' | ||
+ | |||
+ | -g --gather | ||
+ | -a --append | ||
+ | -r --recursive | ||
+ | to copy. Valid only if ' | ||
+ | search pattern. | ||
+ | --help | ||
+ | -v --verbose | ||
+ | --cryptsum [ALGORITHM] | ||
+ | checksums in the output. | ||
+ | and " | ||
+ | " | ||
+ | on Windows Server 2003 and later. | ||
+ | --cryptout [FILE] Write cryptographic checksum to the specified file. | ||
+ | --verify | ||
+ | --verify_original Verifies whether the input has changed while being | ||
+ | copied. | ||
+ | --sparse | ||
+ | --log [FILE] | ||
+ | --lockin | ||
+ | --lockout | ||
+ | --volumelabel [VOLUME_LABEL] | ||
+ | drive with the specified volume label. | ||
+ | specified, the volume name is prepended to the path specified | ||
+ | by ' | ||
+ | --eject | ||
+ | by the ' | ||
+ | --localwrt | ||
+ | --restore_access_times Restores file access times on the source. | ||
+ | --locale [LANG] | ||
+ | --seek [BYTES] | ||
+ | | ||
+ | --skip [BYTES] | ||
+ | | ||
+ | --count [BYTES] | ||
+ | --chunk [BYTES] | ||
+ | | ||
+ | | ||
+ | --comp [ALGORITHM] Compress output using the specified algorithm. | ||
+ | --decomp [ALGORITHM] Decompress output using the specified algorithm. | ||
+ | |||
+ | --allvolumes | ||
+ | for each volume. | ||
+ | --alldrives | ||
+ | each disk. | ||
+ | --random_output_dir Append a random-named output directory to the | ||
+ | specified output path. | ||
+ | |||
+ | BYTES may be suffixed: by xN for multiplication by N, by c for x1, | ||
+ | by w for x2, by b for x512, by KB for x1000, by KiB for x1024, | ||
+ | by MB for x1,000,000, by MiB for x1,048,576, | ||
+ | by GB for x1, | ||
+ | by TB for x1, | ||
+ | |||
+ | BYTES may be prefixed by " | ||
+ | |||
+ | The following options may be used in conjunction with a search pattern | ||
+ | to select the files or streams that are to be processed: | ||
+ | |||
+ | -A, --attributes | ||
+ | |||
+ | attributes | ||
+ | H Hidden files | ||
+ | C Compressed files | ||
+ | O Offline files P Sparse files | ||
+ | S System files | ||
+ | T Temporary files | ||
+ | |||
+ | --any | ||
+ | interpreted. | ||
+ | any one of the specified attributes will be processed. | ||
+ | The default is to hash files with all of the specified | ||
+ | attributes. | ||
+ | |||
+ | The following are used to select files based upon file times: | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | time. | ||
+ | |||
+ | The format of the FILETIME string is specified according to the locale | ||
+ | of the current user. For example, 10:00PM June 6, 2003 is specified | ||
+ | as " | ||
+ | in most european countries. | ||
+ | to search for file times that are less than, equal or greater than | ||
+ | the specified time string. | ||
+ | separated by a semi-colon (;). Multiple conditions are evaluated in pairs. | ||
+ | An un-paired condition is evaluated individually. | ||
+ | |||
+ | The following may be used to select directories, | ||
+ | based upon specified regular expressions: | ||
+ | |||
+ | | ||
+ | expression. | ||
+ | | ||
+ | | ||
+ | expression | ||
+ | | ||
+ | upon the binary contents at the start of | ||
+ | the data stream as evaluated by an | ||
+ | expression. | ||
+ | |||
+ | EXPRESSION may be any regular expression. | ||
+ | may be used to prevent the command interpreter from splitting | ||
+ | a single expression into two or more pieces. | ||
+ | to the --magicfilter option, EXPRESSION is limited to a regular | ||
+ | expression that may be converted to a single byte character set. | ||
+ | |||
+ | The following may be used to select files or streams | ||
+ | based upon the entropy of the initial data stream: | ||
+ | |||
+ | | ||
+ | data streams have an entropy greater than THRESHOLD. | ||
+ | |||
+ | The following may be used in conjunction with output in xml format: | ||
+ | | ||
+ | | ||
+ | XML output. | ||
+ | | ||
+ | |||
+ | The following option may be used to set the thread priority of the program: | ||
+ | |||
+ | | ||
+ | |||
+ | The thread priority may be set to any of the following values: | ||
+ | idle, lowest, belownormal, | ||
+ | abovenormal, | ||
+ | |||
+ | | ||
+ | | ||
+ | master password. | ||
+ | | ||
+ | and sets the starting offset to skip the user accessible | ||
+ | bytes. | ||
+ | | ||
+ | (DCO) and restores the original drive configuration. | ||
+ | |||
+ | Enterprise level options: | ||
+ | |||
+ | --cryptvolumes | ||
+ | | ||
+ | |||
+ | --ssl [CERTIFICATE] | ||
+ | | ||
+ | | ||
+ | | ||
+ | --encrypt [ALGORITHM] | ||
+ | used to encrypt output. | ||
+ | | ||
+ | --cert [PATH] Provides the path to an X-509/ | ||
+ | | ||
+ | used to encrypt output. | ||
+ | | ||
+ | | ||
+ | |||
+ | Report bugs to < | ||
+ | </ | ||