What Is a DD File? Read the First Sector, Then Open the Disk Inside

6 How Do You Open DD Files? 7-Zip, Sleuth Kit, a mount or a Windows viewer

DD files have no program of their own, so a double click usually does nothing useful. You need a tool that reads disks. The table lists what we tried and what we only read about.

Open DD files with 7-Zip

Install 7-Zip, then right-click your DD file and open it as an archive. Or use the command line. The first command lists what is inside, and the second saves it to a folder.

7z l disk.dd
7z x disk.dd -oout

On our MBR and GPT disks with one partition, 7-Zip went straight to the files. On the disk with two partitions it saved both partitions as files, named 0.img and 1.ntfs, and a second pass on those files gave all 4 files from both. It could not open the exFAT DD file and said it cannot open the file as an archive.

Free viewers and reference pages

These four links open outside pages: two Windows viewers for DD files, the GNU manual for dd and the Wikipedia article on dd.

SysTools describes a free Windows viewer that reads DD files. Its page lists previews of EDB, OST and PST email files found inside DD files. It also lists searches by text or file ending and loading of several DD files from one folder. It says DD files of any size load and that the free viewer has no limits. The same page names Windows 10 as supported in one place and unsupported in its FAQ, so check before you install. We did not test it.

Freeviewer describes a Windows viewer that opens DD files and shows file names, dates and sizes. It says the trial version previews items only, and that the Pro edition adds search and extraction. It lists mounting disk images as drives among the Pro features, and it needs the .NET Framework 4.0. Its FAQ also disagrees with its version list about Windows 10. We did not test it either.

Both pages focus on the email files inside DD files. For those formats, see the PST file guide, the OST file guide and the EDB file guide.

7 How Do You Mount a DD File and Copy Files Out? Find the offset, mount read-only and copy

Mounts make DD files look like drives. You open folders and copy files with your usual tools. On Linux the loop device does the work, and it needs the offset because partitions do not start at byte 0.

1. 1 Copy your DD file, make the copy read-only and check its hash against the original.
2. 2 Print the partitions with mmls, sfdisk or fdisk, and note the start sector of the one you want.
3. 3 Multiply the start sector by 512 to get the offset in bytes.
4. 4 Mount the offset read-only, copy the files out and unmount.

mmls g05-mbr-fat32.dd
      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0000075775   0000073728   Win95 FAT32 (0x0c)
003:  -------   0000075776   0000081919   0000006144   Unallocated

The FAT32 partition starts at sector 2,048. Times 512, that is 1,048,576 bytes. Bare file systems have no table, so mmls reports none and you use offset 0.

sudo mkdir -p /mnt/dd
# ext4 partition that starts at sector 2048 (byte 1048576)
sudo mount -o ro,loop,offset=1048576 disk.dd /mnt/dd
# NTFS or exFAT: make a read-only loop device first
sudo losetup --find --show --read-only --offset 1048576 disk.dd
sudo ntfs-3g -o ro /dev/loop0 /mnt/dd
sudo mount.exfat-fuse -o ro /dev/loop0 /mnt/dd
# when you are done
sudo umount /mnt/dd
sudo losetup -d /dev/loop0

We tested all of these forms on our DD files. The kernel mounted the ext4 partitions with the offset option. For NTFS and exFAT we made loop devices with offsets and mounted them with ntfs-3g and mount.exfat-fuse. All four files came back byte for byte from every DD file we mounted.

Get files out without a mount

You can skip the mount, which also skips the need for root. Sleuth Kit lists partitions with fls and saves single files with icat, using the inode number from the list. 7-Zip saves everything. mtools copies from FAT32 with the offset after two at signs.

fls -r -o 2048 disk.dd
icat -o 2048 disk.dd 14 > hello.txt
7z x disk.dd -oout
mcopy -n -s -i disk.dd@@1048576 :: out

8 How Do You Make a DD File With the dd Command? The right block size, one trap and three other tools

The dd command copies bytes from an input to an output. The GNU manual says the default block size is 512 bytes. Bigger blocks mean fewer calls, so the copy goes faster. The table shows a 256 MiB copy on our test machine, from /dev/zero to a file.

Copies in memory are not disk reads, so your times will differ. The gap is the point: the default size was nearly 3 times slower than 1 MiB. The dd page on forensics.wiki says the 512-byte default can be as much as 10 times slower than 4 KiB on disks.

The command, step by step

1. 1 Find the source with lsblk. Check the size and the name, because /dev/sdb on your computer may not be the drive you think.
2. 2 Unmount any partitions of the source, and save the output on another disk with enough room.
3. 3 Enter dd with if= for the source and of= for the new DD file, then wait for it to finish.
4. 4 Hash the source and the DD file, and keep the result with the file.

lsblk
sudo umount /dev/sdb1
sudo dd if=/dev/sdb of=usb.dd bs=4M status=progress
sha256sum /dev/sdb usb.dd

What conv=sync does to the end of DD files

For failing drives, forensics.wiki's imaging notes call conv=noerror,sync a must. With noerror, dd keeps going after read errors. With sync, dd fills the missing bytes with zeros, so the rest of the data stays in place. But sync also pads the last block, and that changes the DD file.

We copied a 41,943,552-byte file with sync at four block sizes. Only the size of one sector gave an exact copy. Every bigger block added zeros at the end, and the hash changed.

Some guides show bs=64836. That number is not a multiple of 512, and it leaves 324 bytes over. On our 41,943,040-byte DD file, conv=sync with that size made a copy 5,852 bytes bigger, and its hash changed. Without conv=sync the same size gave an exact copy. For failing drives, use bs=512 with conv=noerror,sync.

sudo dd if=/dev/sdb of=usb.dd bs=512 conv=noerror,sync status=progress

We could not make a failing disk on our test machine. What we say about read errors comes from the GNU manual and forensics.wiki, and not from our tests.

Short reads in pipes

Pipes may hand dd less data than it asks for. We sent 2,000 chunks of 1,000 bytes into dd with bs=64k and count=10. Without any option, dd stopped at 284,000 bytes, not the 655,360 we asked for. With iflag=fullblock it gave exactly 655,360.

ssh host "dd if=/dev/sdb bs=1M" | dd of=usb.dd bs=1M iflag=fullblock

Other tools that make DD files

Wikipedia names two forks of dd made for forensic work. The fork dcfldd came from a Department of Defense lab and adds checksums while it copies. The fork dc3dd came from the Defense Cyber Crime Center. We tried both, plus ddrescue for damaged drives.

9 How Do You Check a DD File With a Hash? dd does not hash, so compare two numbers

forensics.wiki's hashing note says dd by itself does not hash. So the hash is a second step, and it is the only proof that a copy is exact. Hashes are short fingerprints of files: change one byte and the fingerprint changes.

1. 1 Hash the source drive before or while you copy it, using sha256sum or a tool that hashes as it goes.
2. 2 Hash the finished DD file and compare the two numbers by eye or with sha256sum -c.
3. 3 Save the hash in a text file beside the DD file, and hash again whenever you move or open it.

sha256sum usb.dd > usb.dd.sha256
sha256sum -c usb.dd.sha256
dcfldd if=/dev/sdb of=usb.dd hash=sha256 hashlog=usb.dd.hash bs=1M

We hashed our 40 MiB MBR DD file and copied it 10 ways, then split our 24 MiB ext4 DD file as an extra test. The table shows which copies matched. Every route kept the bytes except one, and the one that failed shows why you should check.

The VHD result is a good warning. The default VHD output rounds the size up to fit its disk geometry, so the DD file that came back was 10,240 bytes longer. With the option force_size=on, the round trip gave the same hash. Quiet success from converters proves nothing until you compare the hashes.

11 How Do You Compress, Split or Convert a DD File? gzip, cat, VMDK, VHD and E01, with a hash check

Raw DD files are big, because they store every byte of the disk, empty space included. Our DD files are mostly empty, so they shrink a lot. Disks full of files shrink much less. The table shows our 40 MiB MBR DD file after five routes.

gzip -k disk.dd
split -b 8M -d -a 3 disk.dd disk.dd.
cat disk.dd.* > joined.dd
dd if=disk.dd of=sparse.dd bs=1M conv=sparse
qemu-img convert -f raw -O vmdk disk.dd disk.vmdk
qemu-img convert -f raw -O vpc -o force_size=on disk.dd disk.vhd

The sparse option makes dd skip blocks of zeros. A 16 MiB DD file of zeros used 16,384 KB on disk, and the sparse copy used 0 KB with the same hash. Split parts join back with cat, and the 3 parts of our ext4 DD file gave the same hash.

Convert DD files to virtual disks

qemu-img reads DD files as raw disks and writes virtual disks. The VMDK file guide, the VDI file guide and the VHD file guide explain how those formats open. All three came back to the same bytes, but default VHD output grew by 10,240 bytes, as the verify section shows.

Convert DD files to E01 evidence files

E01 files add a header, a case record and a stored hash, and they compress the data. The E01 evidence file guide explains the format. We made one with ewfacquire from the libewf tools and checked it with ewfverify. The MD5 inside matched the MD5 of our source.

ewfacquire -u -t disk -c deflate:fast -S 0 -C case1 -D desc -e examiner -E ev1 -N notes -m fixed -M logical -f encase6 disk.dd
ewfverify disk.E01