Table of Content
Detail Information on DD File
Join Discussion

What is DD File Extension? Understanding Forensic DD Image

DD file is a disk image file and replica of a hard disk drive. The file having extension .dd is usually created with an imaging tool called DD. The utility provides command line interface to create disk images in a system running UNIX & LINUX OS.

  • DD file, sometimes referred as forensic dd image, is often used to investigate Linux hard disk data in Windows OS.
  • In Linux, DD utility uses the following command to create a dd image file:
    • dd if=/dev/hdr of=mydisk.dd
      if is an input file
      /dev/hdr is a physical disk of linux
      of is an output file
      mydisk.dd is a name of the destination file
    • dd if=/dev/hdr of=mydisk.dd bs=64836 conv=noerror,sync
      bs is block size
      conv=noerror parameter makes the command continue to run even if any read error occurs from source drive.
      sync If error occurs then null fill the rest of the block
  • In Windows, DD utility uses the following command to create a dd disk image:
    • dd.exe if=\\.\PhysicalDrive0 of=d:\images\PhysicalDrive0.dd
      This cmd will create a duplicate copy of a source drive