target-dd

With target-dd you can export (a part of) a target to a file or to stdout. At the moment, target-dd can be used for targets that have only one disk.

Usage

target-dd - CLI interface

dissect.target

target-dd [-h] [-w WRITE] [-o OFFSET] [-b BYTES] [-K KEYCHAIN_FILE] [-Kv KEYCHAIN_VALUE]
          [-L LOADER] [--child CHILD] [--children] [--list-children] [--recursive] [-v]
          [--version] [-q] [--plugin-path PLUGIN_PATH [PLUGIN_PATH ...]]
          TARGET

target-dd positional arguments

  • TARGET - Target to dd from (default: None)

target-dd options

  • -h, --help - show this help message and exit

  • -w WRITE, --write WRITE - output file (default: -)

  • -o OFFSET, --offset OFFSET - offset to read from. (default: 0)

  • -b BYTES, --bytes BYTES - amount of bytes to read (default: -1)

  • -K KEYCHAIN_FILE, --keychain-file KEYCHAIN_FILE - keychain file in CSV format (default: None)

  • -Kv KEYCHAIN_VALUE, --keychain-value KEYCHAIN_VALUE - passphrase, recovery key or key file path value (default: None)

  • -L LOADER, --loader LOADER - select a specific loader (i.e. vmx, raw) (default: None)

  • --child CHILD - load child of target by path of index (see –list-children) (default: None)

  • --children - include children

  • --list-children - list all children indices and paths, then exit (default: False)

  • --recursive - make –list-children behave recursively

  • -v, --verbose - increase output verbosity (default: 0)

  • --version - print version

  • -q, --quiet - do not output logging information

  • --plugin-path PLUGIN_PATH - a file or directory containing plugins and extensions (default: None)

For more information on the -K, --keychain-file and -Kv, --keychain-value arguments, please refer to Disk encryption (FVE).