diff --git a/forensics/basic-forensics-esp/linux-forensics.md b/forensics/basic-forensics-esp/linux-forensics.md
index 05c6a2ee3..637ac645a 100644
--- a/forensics/basic-forensics-esp/linux-forensics.md
+++ b/forensics/basic-forensics-esp/linux-forensics.md
@@ -71,7 +71,7 @@ dd if=<subject device> of=<image file> bs=512
 
 #Raw copy with hashes along the way (more secur s it checks hashes while it's copying the data)
 dcfldd if=<subject device> of=<image file> bs=512 hash=<algorithm> hashwindow=<chunk size> hashlog=<hash file>
-dcfldd if=<subject device> of=/media/usb/pc.image hash=sha256 hashwindow=1M hashlog=/media/usb/pc.hashes
+dcfldd if=/dev/sdc of=/media/usb/pc.image hash=sha256 hashwindow=1M hashlog=/media/usb/pc.hashes
 ```
 
 ## Search for known Malware