dcfldd/dcfldd.1

.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.35.
.TH DCFLDD "1" "February 2006" "dcfldd (dcfldd) 1.3.4" "User Commands"
.SH NAME
dcfldd \- enhanced version of dd for forensics and security
.SH SYNOPSIS
.B dcfldd
[\fIOPTION\fR]...
.SH DESCRIPTION
Copy a file, converting and formatting according to the options.
.TP
bs=BYTES
force ibs=BYTES and obs=BYTES
.TP
cbs=BYTES
convert BYTES bytes at a time
.TP
conv=KEYWORDS
convert the file as per the comma separated keyword list
.TP
count=BLOCKS
copy only BLOCKS input blocks
.TP
ibs=BYTES
read BYTES bytes at a time
.TP
if=FILE
read from FILE instead of stdin
.TP
obs=BYTES
write BYTES bytes at a time
.TP
of=FILE
write to FILE instead of stdout
.IP
NOTE: of=FILE may be used several times to write
.IP
output to multiple files simultaneously
.TP
of:=COMMAND
exec and write output to process COMMAND
.TP
seek=BLOCKS
skip BLOCKS obs\-sized blocks at start of output
.TP
skip=BLOCKS
skip BLOCKS ibs\-sized blocks at start of input
.TP
pattern=HEX
use the specified binary pattern as input
.TP
textpattern=TEXT
use repeating TEXT as input
.TP
errlog=FILE
send error messages to FILE as well as stderr
.TP
hashwindow=BYTES
perform a hash on every BYTES amount of data
.TP
hash=NAME
either md5, sha1, sha256, sha384 or sha512
.IP
default algorithm is md5. To select multiple
algorithms to run simultaneously enter the names
in a comma separated list
.TP
hashlog=FILE
send MD5 hash output to FILE instead of stderr
.IP
if you are using multiple hash algorithms you
can send each to a separate file using the
convention ALGORITHMlog=FILE, for example
md5log=FILE1, sha1log=FILE2, etc.
.TP
hashlog:=COMMAND
exec and write hashlog to process COMMAND
.IP
ALGORITHMlog:=COMMAND also works in the same fashion
.TP
hashconv=[before|after]
perform the hashing before or after the conversions
.TP
hashformat=FORMAT
display each hashwindow according to FORMAT
.IP
the hash format mini\-language is described below
.TP
totalhashformat=FORMAT
display the total hash value according to FORMAT
.TP
status=[on|off]
display a continual status message on stderr
.IP
default state is "on"
.TP
statusinterval=N
update the status message every N blocks
.IP
default value is 256
.TP
sizeprobe=[if|of]
determine the size of the input or output file
.IP
for use with status messages. (this option
gives you a percentage indicator)
WARNING: do not use this option against a
.IP
tape device.
.TP
split=BYTES
write every BYTES amount of data to a new file
.IP
This operation applies to any of=FILE that follows
.TP
splitformat=TEXT
the file extension format for split operation.
.IP
you may use any number of 'a' or 'n' in any combo
the default format is "nnn"
NOTE: The split and splitformat options take effect
.IP
only for output files specified AFTER these
options appear in the command line.  Likewise,
you may specify these several times for
for different output files within the same
command line. you may use as many digits in
any combination you would like.
(e.g. "anaannnaana" would be valid, but
quite insane)
.TP
vf=FILE
verify that FILE matches the specified input
.TP
verifylog=FILE
send verify results to FILE instead of stderr
.TP
verifylog:=COMMAND
exec and write verify results to process COMMAND
.TP
\fB\-\-help\fR
display this help and exit
.TP
\fB\-\-version\fR
output version information and exit
.PP
The structure of of FORMAT may contain any valid text and special variables.
The built\-in variables are used the following format: #variable_name#
To pass FORMAT strings to the program from a command line, it may be
necessary to surround your FORMAT strings with "quotes."
The built\-in variables are listed below:
.TP
window_start
The beginning byte offset of the hashwindow
.TP
window_end
The ending byte offset of the hashwindow
.TP
block_start
The beginning block (by input blocksize) of the window
.TP
block_end
The ending block (by input blocksize) of the hash window
.TP
hash
The hash value
.TP
algorithm
The name of the hash algorithm
.SS "For example, the default FORMAT for hashformat and totalhashformat are:"
.IP
hashformat="#window_start# \- #window_end#: #hash#"
totalhashformat="Total (#algorithm#): #hash#"
.SS "The FORMAT structure accepts the following escape codes:"
.TP
\en
Newline
.TP
\et
Tab
.TP
\er
Carriage return
.TP
\e\e
Insert the '\e' character
.TP
##
Insert the '#' character as text, not a variable
.PP
BLOCKS and BYTES may be followed by the following multiplicative suffixes:
xM M, c 1, w 2, b 512, kD 1000, k 1024, MD 1,000,000, M 1,048,576,
GD 1,000,000,000, G 1,073,741,824, and so on for T, P, E, Z, Y.
Each KEYWORD may be:
.TP
ascii
from EBCDIC to ASCII
.TP
ebcdic
from ASCII to EBCDIC
.TP
ibm
from ASCII to alternated EBCDIC
.TP
block
pad newline\-terminated records with spaces to cbs\-size
.TP
unblock
replace trailing spaces in cbs\-size records with newline
.TP
lcase
change upper case to lower case
.TP
notrunc
do not truncate the output file
.TP
ucase
change lower case to upper case
.TP
swab
swap every pair of input bytes
.TP
noerror
continue after read errors
.TP
sync
pad every input block with NULs to ibs\-size; when used
with block or unblock, pad with spaces rather than NULs
.SH AUTHOR
Written by: dcfldd by Nicholas Harbour, GNU dd by Paul Rubin, David MacKenzie and Stuart Kemp.
.SH "REPORTING BUGS"
Report bugs to <nicholasharbour@yahoo.com>.
.SH COPYRIGHT
Copyright \(co 1985-2006 Free Software Foundation, Inc.
.br
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
.SH "SEE ALSO"
The full documentation for
.B dcfldd
is maintained as a Texinfo manual.  If the
.B info
and
.B dcfldd
programs are properly installed at your site, the command
.IP
.B info dcfldd
.PP
should give you access to the complete manual.