Q1: The dcfldd command is an enhanced version of dd developed by the U.S. Department of Defence Computer Forensics Lab. It has some useful features for forensic investigators such as:

On-the-fly hashing of the transmitted data.
Progress bar of how much data has already been sent.
Wiping of disks with known patterns.
Verification that the image is identical to the original drive, bit-for-bit.
Simultaneous output to more than one file/disk is possible.
The output can be split into multiple files.
Logs and data can be piped into external applications.
In a forensic investigation, it is important to make sure than anything you do does not effect the data on the disk being investigated. In the case of this investigation, the USB stick has been attached as a device called /dev/sdd.

Use md5sum to calculate the md5 checksum of the usb stick attached to /dev/sdd, and save the hash into /home/caine/usb.md5. Use sha256sum to calculate the sha 256 checksum of the usb stick attached to /dev/sdd, and save the hash into /home/caine/usb.sha256. Note the check buttons may take quite a few seconds to check the correct hashes.


Answer:

 md5sum /dev/sdd > usb.md5
 sha256sum /dev/sdd > usb.sha256



Q2: Use the dcfldd command to capture this usb device. Use the format:

dcfldd if=/dev/sdd hash=md5,sha256 md5log=md5.txt sha256log=sha256.txt hashconv=after bs=512 conv=noerror of=usb.dd
Confirm that the md5 and sha256 you took of /dev/sdd matches the md5.txt and sha256.txt files created during this transfer.


Answer:

dcfldd if=/dev/sdd hash=md5,sha256 md5log=md5.txt sha256log=sha256.txt hashconv=after bs=512 conv=noerror of=usb.dd