General tools Imaging tools dd, of course. Note that it makes sense to set the prop­er block size (some­times 4k, but most hard dri­ves are using 512), so that, when an error occued, the exact sec­tor is shown which can after­wards be skipped. dd if=/dev/sda of=/external/file.md5 bs=512 ewfacquire sudo ewfac­quire /dev/sda Advan­tages: aff4 advanced forensic…