Paladin uses DC3DD for RAW (dd) images and EFWACquire for E01 images.Ī popular free imaging tool developed by Guy Voncken.

Paladin is a modern bootable Linux distribution with a really good user interface and great imaging capabilities. Paladin isn’t a real imaging tool as it’s more of a complete forensic investigation environment. It’s able to create RAW (dd) and E01 images. The Belkasoft Acquisition Tool is gaining a lot of popularity among forensic investigators because of its portability versatility and ease of use.īAT is able to create images from physical and logical drives, mobile devices running iOS and Android (full physical images if rooted) and cloud storage. Visit Opentext Belkasoft Acquisition Tool by Belkasoft It only supports the encase imaging formats E01 and Ex01. While the interface can be very intimidating for first-time users, the tool offers some great features.Įncase Forensic Imager is able to perform imaging on a physical and logical drive as well on logical file-level. Visit Accessdata Encase Forensic Imager by OpenTextĪlong with FTK Imager the most popular imaging tool on the market. Supported imaging formats include RAW (dd), SMART, E01 and AFF. It’s capable of converting images from and to other image types. FTK Imager includes the functionality to capture the system Registry and physical ram.

You are able to perform basic forensic analysis and file recovery right from within FTK Imager.įTK Imager supports a wide variety of image sources, Physical and Logical drives are supported as well as logical file-level images. It can also mount images as a physical and/or logical drive and has a very capable evidence browser build in. Regardless of its name, FTK Imager does a lot more than only imaging.

Belkasoft Acquisition Tool by BelkasoftĪlong with Encase Forensic Imager the most popular imaging tool on the market.

Table of contents:įor this comparison, I decided to select six well-known forensic imaging tools.

While I have included a top 3 of the, in my opinion, best imaging tools, I highly recommend that you match your requirements from a tool with the results of the tests below. In this comparison, I picked six well-known imaging tools and compared their features, ease of use and performance. However, there is nothing wrong with checking new tools from time to time. I picked them up throughout the years and they do their job. Most tools I use during my investigation are used without a second thought. This is a comparison I wanted to do for a long time, I have always wondered if there would be a noticeable performance difference between the tools. In this post, I will compare six forensic imagers. When creating a forensic image you always try to pick the best tool for the job. There are a few good imaging tools out here.

Encase free alternative