acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and a well-sequenced, validation-backed workflow appropriate for destructive forensic acquisition. Its main weaknesses are mild verbosity from redundant concept/tool tables and poor progressive disclosure: the provided api-reference.md and agent.py bundle files are never signaled from the body, and their content is partly duplicated inline.

Suggestions

Link the bundle files from the body — e.g., add an 'API reference: see references/api-reference.md for full dd/dcfldd flag tables' and 'Automation: scripts/agent.py wraps this workflow' note, and remove the inlined flag detail that duplicates the reference.

Trim the 'Key Concepts' table entries that restate well-known notions (bit-for-bit copy, write blocker, hash verification) to reduce token overhead, keeping only forensic-specific nuances like conv=noerror,sync offset alignment.

Add an explicit error-recovery feedback loop in Step 5 (e.g., 'if source/image hashes differ, re-run acquisition and document the discrepancy') to lift workflow clarity to the top anchor.

Dimension	Reasoning	Score
Conciseness	The workflow commands are mostly efficient and executable, but the 'Key Concepts' table explains notions Claude already knows (bit-for-bit copy, write blocker, hash verification) and the 'Tools & Systems' table duplicates flag detail already present in references/api-reference.md, adding token overhead that could be tightened.	3 / 5
Actionability	Provides copy-paste-ready, fully executable bash commands covering the common cases — dd basic/compressed/partial acquisition, dcfldd with hashing/split/verify, hash comparison via diff, and report generation — with concrete paths and flags.	5 / 5
Workflow Clarity	Six steps are clearly sequenced with explicit validation checkpoints (write-block verification in Step 1, pre/post source hashing and image-hash diff in Step 5), but an explicit error-recovery feedback loop (e.g., 'if hashes mismatch, re-acquire') is only implied rather than stated, leaving a minor gap versus the anchor above.	4 / 5
Progressive Disclosure	Bundle files references/api-reference.md and scripts/agent.py exist but are never referenced or linked from the body, while API-style option tables that belong in the reference file are inlined directly — content that should live in a separate file is inlined and the provided references are orphaned.	2 / 5
	Total	14 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is excellent: it states concrete capabilities with named tools, provides explicit 'Use when' trigger guidance with natural synonyms, and carves out a distinct forensic niche with minimal overlap risk. It uses third-person voice throughout, incurring no voice penalty.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (create bit-for-bit disk images, preserve evidence integrity through MD5/SHA hash verification) with named tools (dd, dcfldd) and a defined Linux forensic workstation context, giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both 'what' (create forensically sound bit-for-bit images with hash verification) and 'when' via a concrete 'Use when...' clause with multiple trigger scenarios.	5 / 5
Trigger Term Quality	Covers natural user phrases and synonyms across the niche — 'imaging a suspect drive, USB device, or memory card', 'incident response', 'legal or law-enforcement proceedings', 'destructive analysis' — that a user would naturally say.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear forensic-disk-imaging niche with tool-specific triggers (dd/dcfldd, suspect drive, write-blocker, chain of custody), making conflict with unrelated skills minimal.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.