Create and Restore Disk Image Files with OSForensics

OSForensics lets you extract forensic evidence from computers quickly with high performance file searches and indexing. Identify suspicious files and activity with hash matching, drive signature comparisons, e-mails, memory and binary data. Manage your digital investigation and create reports from collected forensic data.

The disk imaging functionality allows the investigator to create and restore disk image files, which are bit-by-bit copies of a partition, physical disk or volume. Disk imaging is essential in securing an exact copy of a storage device, so it can be used for forensics analysis without risking the integrity of the original data. Conversely, an image file can be restored back to a disk on the system.