dd (Raw Disk Image).

A flat, bit-for-bit copy of a storage device produced by the Unix dd utility (or compatible tools), without compression, metadata or per-block hashing. It belongs to the Forensics & IR category of cybersecurity.

A flat, bit-for-bit copy of a storage device produced by the Unix dd utility (or compatible tools), without compression, metadata or per-block hashing.

A dd image is the simplest possible forensic acquisition: a sector-by-sector raw copy of a disk, partition or memory device written to one or more files. The name comes from the venerable Unix dd command, and the format is essentially defined by what dd writes: no header, no metadata, no compression and no embedded hashes. Variants such as dcfldd, dc3dd and ewfacquire add logging, hashing and split output but keep the same raw layout. Every forensic tool can read a dd image, which makes it ideal for archival and tool-agnostic analysis, but examiners typically pair it with an external hash list and chain-of-custody record.

Defences for dd (Raw Disk Image) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Raw image, .dd, .img, .raw.