#This will generate a raw copy of the diskddif=/dev/sdbof=disk.img
dcfldd
#Raw copy with hashes along the way (more secur as it checks hashes while it's copying the data)dcflddif=<subjectdevice>of=<imagefile>bs=512hash=<algorithm>hashwindow=<chunksize>hashlog=<hashfile>dcflddif=/dev/sdcof=/media/usb/pc.imagehash=sha256hashwindow=1Mhashlog=/media/usb/pc.hashes
ewfacquire/dev/sdb#Name: evidence#Case number: 1#Description: A description for the case#Evidence number: 1#Examiner Name: Your name#Media type: fixed#Media characteristics: physical#File format: encase6#Compression method: deflate#Compression level: fast#Then use default values#It will generate the disk image in the current directory
cannot mount /dev/loop0 read-only 在这种情况下，您需要使用标志 -o ro,norecovery
wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error. 在这种情况下，挂载失败是因为文件系统的偏移量与磁盘映像的偏移量不同。您需要找到扇区大小和起始扇区：
