GetData Forensic Imager – Program to Take Forensic Image
GetData Forensic Imager is a Windows based program that will acquire, convert, or verify a forensic image in one of the following common forensic file formats:
- DD /RAW (Linux “Disk Dump”)
- AFF (Advanced Forensic Format)
- E01 (EnCase®)
Forensic Image provides three separate functions:
- Acquire: The acquire option is used to take a forensic image (an exact copy) of the target media into an image file on the investigators workstation;
- Convert: The convert option is used to copy an existing image file from one image format to another, e.g. DD to E01;
- Hash or verify: The hash or verify option is used to calculate a hash value, MD5, SHA1 or SHA256, for a device or an existing image file.

GetData Forensic Imager – Windows Program to Acquire, Convert, or Verify a Forensic Image
System Requirements
- Forensic Imager should be run as local Administrator to ensure that sufficient access rights are available for access to devices.
- Forensic Imager uses EnCase® v6 E01 format. Images independently verified with EnCase® should be done using V6 or above.
- Forensic Imager does NOT support DOS acquisition. If acquisition from a DOS boot disk is required alternative forensic acquisition software should be used.
- Forensic Imager does not currently support the acquisition of HPA or DCO areas. The HPA and DOC are two areas of a hard drive that are not normally visible to an operating system or an end user. Whilst the HPA and DCO are hidden, it is technically possible for a user to access these areas and store/hide data.
You can read more and download latest release over here: http://www.forensicimager.com/
Subscribe
0 Comments