Revision as of 08:54, 23 July 2018 by SalvationDATA1610
TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...
- Atola Insight Forensic
- All-in-one fast forensic acquisition system produced by Atola Technology capable of diagnosing and imaging damaged and unstable drives http://atola.com/products/insight/
- Data Compass
- SalvationDATA upgraded Data Compass and HD Doctor into the next generation intelligent all-in-one forensic data recovery tool: DRS (Data Recovery System), for more information, you can visit the website: http://www.salvationdata.com/drs-data-recovery-system.html
- DeepSpar Disk Imager
- Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html - Data Sheet and Whitepaper available for download from product web page.
- Data copy king
- DCK 2 is the second generation forensic data eraser and disk duplicator tool produced by SalvationDATA, equipped with multi-function write-blockers, and embedded high capacity storage drive, DCK 2 is a fully portable device designed for both field and laboratory applications. With embedded read-only SATA/USB and multi-function card reader interfaces, DCK 2 provides a one-stop solution to most common storage devices. DoD standard data erasure ensures zero possibility to recover any digital data wiped by DCK 2. DCK 2, a must-have tool in your digital forensic laboratory or information security department. http://www.salvationdata.com/dck-data-copy-king.html
- ICS Solo3
- Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
- Logicube Talon
- Supports USB
- Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
- Enhanced Error Handling and Logging
- Voom HardCopy III
- Allows destination drive to be formatted in NTFS.
- guymager supports all relevant forensic formats (dd, ewf, aff). It is very user friendly and faster than known commercial imagers running under Windwos. As it is based on libewf, it supports all the different subformats found in libewf.
- Part of the libewf package, ewfacquire can create evidence files in the Expert Wittness Compression Format, like EnCase and FTK Imager .E01 (EWF-E01) and SMART .s01 (EWF-S01) formats. ewfacquire calculates an MD5 integrity hash while the data is being imaged. Ewfacquire provides support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
- Part of the AFF system, aimage can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. aimage can optionally compress and calculate MD5 or SHA-1 hash residues while the data is being copied. It has intelligent error recovery, similar to what is in ddrescue.
- AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
- A version of dd created by the Digital Computer Forensics Laboratory. dcfldd is an enhanced version of GNU dd with features useful for forensics and security, such as calculating MD5 or SHA-1 hashes on the fly and faster disk wiping.
- A program that converts and copies files, is one of the oldest Unix programs. I can copy data from any Unix "file" (including a raw partition) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces raw image files. Extended into dcfldd.
- EnCase LinEn
- Linux-based version of EnCase's forensic imaging tool.
- A tool similar to dd, but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
- iLook IXimager
- The primary imaging tool for iLook. It is Linux based and produces compressed authenticatable image files that may only be read in the iLook analysis tool.
- Self booting open source version of Tiny Core Linux using dc3dd with RAW and AFF support.
- Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
- Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
- Can image and convert many file formats. Also builds mobile toolkit.
- Can image with out dongle plugged in. Only images to E0* file.
- FTK Imager by AccessData
- Can image and convert many image formats. Including E0* (EWF-E01), s0* (EWF-S01) and dd. Also a free tool.
- ReclaiMe Pro
- Highly configurable high-speed imager, suitable for slight to moderate bad block cases. Sector-by-sector, VHD, and VHDX output.
- X-Ways Forensics
- Can image and convert raw dd and EnCase E0* image formats.
- It can also create logical container images and has reverse imaging capability as well.
- The logical container images are similar in function to a EnCase L01 file, but they use simulated NTFS internal structure to maintain all the metadata. The end result is that x-ways, encase, and mount image pro can all read a x-ways created logical container files.