Creating a dd/dcfldd Image Using Automated Image & Restore (AIR)

What is Automated Image & Restore

Automated Image & Restore (AIR) is an open source application that provides a GUI front end to the dd/dcfldd (Dataset Definition (dd)) command. AIR is designed to easily create forensic disk/partition images. It supports MD5/SHAx hashes, SCSI tape drives, imaging over a TCP/IP network, splitting images, and detailed session logging. To date, the AIR utility has only been developed for use on Linux distributions. In its simplest form, AIR provides a convenient interface to execute the dd set of commands. It eliminates the risk of "fat fingering" an error in the shell terminal and ultimately makes using the dd command more user-friendly for those who are not as experienced. Please note that using the AIR front end still requires some basic knowledge of how the dd (or dcfldd) commands work.

The dd command has been around for quite a while. It is well known throughout the Unix/Linux community, well documented, and as I can only imagine extensively used. A dd image is a bit by bit image of a source device or file. The uses for dd range from creating and maintaining system backups and restore images to the forensic application of imaging evidence that will be returned to the lab and examined.

This tutorial is not designed to teach the use of the dd command; this is well documented and a simple internet search will yield a plethora of results. Instead, the intent of this mini "how-to" is to introduce users to the AIR front end application, increase overall awareness of the utility, and provide a brief example of creating a dd image using this tool.

DISCLAIMER: I do not claim to be expert at using dd or Automated Image & Restore.

Setting up AIR

The first thing you will want to do is download and install the latest version of the AIR application. The AIR application is available for download at

Once you have downloaded the files to your system, decompress, extract, and install the application. [In this example, I have downloaded the .tar.gz package and will display the commands related to this particular file type]

-- Make sure you are in a root shell

sudo -s

-- Check your current directory to make sure you are in the right location to access the package you downloaded


-- Decompress and extract ("untar") the AIR files

tar -zxvf /path/air-1.2.8.tar.gz

-- If you desire, this is a good time to read the README.txt file

-- Switch to your AIR directory

cd /path/air-1.2.8

-- Run the install script



Note that AIR does not work on all Linux distributions. Refer to the project information on and the README.txt file for a list of known supported distibutions - I am using Ubuntu which is not among the list. Ubuntu can still run AIR, however, some functionality is unavailable. Now that you have successfully downloaded and installed the application, run AIR in root shell by typing "air" in the terminal. AIR will run through a series of checks and the GUI will launch automatically.

Take a moment to familiarize yourself with the AIR GUI. Note how the buttons and options relate to various dd commands that can be used in the terminal.


Creating a dd Image Using AIR

For this exercise, we will create a dd image of a .jpg in the root folder and copy it to a CD-ROM. AIR will run the commands behind the scenes that will create the image and copy it to the CD-ROM. (In a real scenario, this .jpg could very easily represent a compromised hard drive or other piece of evidence).

First, select the source device or file that you would like to image. This can be a particular drive/partition, a file such as a .jpg, a folder, or any number of other items on a computer. We'll select /root/ectf.jpg which is the original file.

Next, select the destination device/file where you would like the image to be copied. We'll choose /dev/hdc which represents the CD/DVD drive.


[Note, selecting the source and destination devices/files can be done a few different ways:

A. Choose source/destination from the drop-down list in the toolbar - may not be available if using an unsupported Linux distribution
B. Click the folder button to browse folders on your system
C. Click on the desired "Connected Devices" button at the bottom of the application and set as source or destination
D. Type the known path in the source/destination window]



After identifying the source and the destination, choose the desired block size of your source and destination devices/files. It is recommended that these match. This step requires some knowledge of your source device/file and an understanding of block sizes. [General information on block sizes can be found through web search].


Lastly, you are presented with a few options to tailor your image. Here you have the ability to choose device/file compression, hash method, and whether or not you would like to verify the hashes post image.



At this point, you have identified all the necessary criteria to create your dd image. Click "Start" and let AIR do the rest. Click on "Show Status Window" to view the commands which AIR is running in the background. The status window will display a detailed logging summary. This is where you can view the data transfer status and hash verification results.


IMPORTANT: The hash values MUST be identical to ensure you have an exact dd image of the source device/file.

Congratulations! You have just created a dd image using the Automated Image & Restore GUI front end application.

Share this page:

8 Comment(s)

Add comment


From: at: 2008-04-13 17:18:27

The instructions leave out some important points for Ubuntu 7.10

If you get this -  FATAL ERROR:

"The uudecode program could not be found on your system..."

Then run this in the terminal - sudo apt-get install sharutils 

I also got this:

"Perl/Tk is not installed on your system or you have a version
(0) other than what is called for, so for the installation
to proceed, it will have to be downloaded from the CPAN site on
the Internet.  This means your system must be connected to a
network with Internet access and properly configured.  If you
can surf the web then you should be okay.

Once Perl/Tk is downloaded (approx 5.8M), it will automatically
be compiled and installed."

I checked perl --version and got -

This is perl, v5.8.8 built for i486-linux-gnu-thread-multi

Copyright 1987-2006, Larry Wall

So, I'm not sure which version of Perl this is looking for, but I'm not continuing with the installation until I get it sorted out. If it's looking for an older version of Perl, then maybe the package needs updating...


From: Anonymous at: 2010-02-24 14:25:58

This is typical Linux installation where nothing works.


Typical advice is "You just type this and this and then it's atomatically installed..." NOT IT'S NOT


This is so DOS.

"Perl/Tk is not installed on your system or you have a version
(804.028) other than what is called for, so for the installation
to proceed. Once Perl/Tk is downloaded, it will automatically be compiled
and installed."



This Application got all the AIR out of the system... These kind of installations is why people uses Windows. Catastrophic...

From: at: 2008-04-13 17:26:23

Ok - update from last post:

if you get the message complaining about Perl/Tk,

go to a terminal and do this: sudo apt-get install perl-tk

That solves the second missing point. The installation will continue as expected. 


From: at: 2008-04-13 17:30:12

Yikes - another missing part...

When air starts, you may get a nasty message about encrypting data.

If you do, in a terminal (again)...

sudo apt-get install cryptcat

(You will need to restart air for this to go away) 

From: Anonymous at: 2008-12-09 19:54:38

I was able toCreate a dd/dcfldd Image Using Automated Image & Restore (AIR). Now I would like to restore it into a Virtual Machine. Could somebody please help? TIA.

From: Anonymous at: 2009-12-01 07:39:23

Sun Virtualbox (multi-platform freeware from has a command line utility that can convert raw disk images (e.g. dd images) to either VDI (Sun Virtualbox), VMDK (e.g. vmware) or VHD (Microsoft) virtual machine disk images.  See the Virtualbox user manual, and lookup or search for the command "VBoxManage convertfromraw".

 Example command:

VBoxManage convertfromraw --format VMDK --variant fixed ImageFile.dd OutputFile.vmdk


This command would take a dd image file called ImageFile.dd and create a byte by byte file (i.e. non-compressed, and approximately the same size as the dd file) called OutputFile.vmdk.

Though the post I am replying to on this is quite old, I hope this is able to help someone who may come across this topic via search.

From: Anonymous at: 2011-02-01 13:58:25

Check out LiveView -

LiveView makes converting dd images to VMs easy.

From: BobC at: 2013-06-07 19:00:54

Air will install under Cygwin, but there are some things to be aware of.

First, Air will only run under Cygwin-X, since Tk requires X under Cygwin.  Be sure to start the XWin Server as Administrator!

Second, since the Air installer Tk version check is broken, you need to bypass it.  Do the following from a bash prompt:

First, ensure Tk is installed and is current:

cpan install Tk

Then check the current version:

 perl -e 'use Tk;print "$Tk::VERSION";'

 And export that value:

export PERLTK_VER="804.031"

 When you first try to run Air it will complain about several missing applications.  Check for them in the following order:

  1. Cygwin installer
  2. Search for the program name ("whatever.exe") with "cygwin".
  3. Search for the program name ("whatever.exe") alone.
  4. Get the source and build it under Cygwin.
  5. Get the source and build it under Windows.

The only application I couldn't find a Cygwin or Windows executable for was cryptcat, which I fortunately don't need.

Finally, Air will sometimes start with errors like this:

0 [main] perl 9336 child_info_fork::abort: address space needed by 'Menubutton.dll' (0x7F0000) is already occupied

 When this happens, hit ^C and try again.  It may take several times, but it will eventually start normally.