Audience
Digital forensic examiners, law enforcement, legal teams, incident responders and corporate investigators.
About Sherlock Forensics Disk Imager
Sherlock Forensics Disk Imager is a Windows desktop tool for creating forensic images of physical drives for digital evidence acquisition. It writes raw DD images, including segmented files, and EWF E01 images that can be opened by forensic analysis tools. The imager records case, evidence and examiner details in a manifest and E01 metadata, computes SHA-256 hashes, and supports SHA-1 and MD5. Its verification workflow reads the source and completed image to check data integrity; additional functions include bad-sector logging, a live acquisition console, and a safeguard against saving an image to the same physical drive being read. Intended for digital forensic examiners, law enforcement, incident responders and corporate investigators, it supports dead-disk and Windows live-acquisition workflows on 64-bit Windows 10 and 11. The standalone executable runs locally without an installer or runtime dependencies.
Other Popular Alternatives & Related Software
Sherlock Forensics iPhone and iPad Analyzer
Sherlock Forensics iPhone and iPad Analyzer is Windows software for acquiring and examining iPhone and iPad evidence through logical MobileBackup2 backups. It also analyzes Cellebrite UFED and Inseyets full-filesystem extractions created with separate acquisition tools. The application runs fully offline and does not modify evidence. It decrypts encrypted backups and organizes data into more than 200 searchable artifact views for messages, calls, contacts, Safari history, Apple Notes, Maps and other app data. The free edition previews 25% of each artifact view, capped at 100 rows. The Forensic Edition adds unlimited data, global search, CSV and JSON export, a court-ready HTML report, a raw SQLite browser, file extraction and screen capture. It can flag deleted records recovered from the examined data. Users include digital forensic examiners, investigators, law enforcement, legal teams and forensic labs that review and document mobile-device evidence.
Learn more
DataNumen Disk Image
DataNumen Disk Image is a powerful tool to clone and restore disks or drives. It can create and restore the disk image or drive image byte by byte. Useful for data backup & recovery, disk/drive copy & cloning, and forensic. Support all kinds of disks and drives. Support for Windows and Windows Server. Support to restore image data back to drives. Support to clone data from corrupted media. Support to replace damaged sectors with specified data. Support to clone multiple disks and drives in batch. Ideal to be used as a computer forensic tool and electronic discovery (or e-discovery, eDiscovery) tool. With DataNumen Disk Image, you can create images for drives and disks, for various purposes, such as backup, restore, forensics and data recovery. Before creating drive or disk images with DataNumen Disk Image, please close any other applications. After the clone process, if the image file is created successfully, you will see a message box.
Learn more
Active@ Disk Image
Active@ Disk Image is a disk image software that makes an exact copy of any PC disk (HDD, SSD, USB, CD, DVD, Blu-ray etc.) and stores it into a folder. The disk images may be used for backups, PC upgrades or disk duplication purposes. In case of computer failure, a backup image may be used to recover your computer system or find & restore any necessary files from within an image. Create & Restore Disk Image Backup (occupied clusters only). Image Compression (Fast, Normal and High). Mounting images as virtual drives. Incremental and Differential images. RAID is supported. Rescue bootable media. Create & restore raw disk image (sector by sector copy). Scheduled backups. Windows Servers are supported. Image Encrypting (AES-128, AES-192, AES-256). Scripting support. E-mail notifications. Cloud storage.
Learn more
Android Acquirer
Android Acquirer is desktop software for consent-based logical acquisition and examination of Android phones and tablets. It connects through Android Debug Bridge (ADB) and a helper application to collect selected device data, including messages, contacts, call records, media, apps and artifacts. Examiners can review extracted records, preserve acquisition details and produce forensic PDF reports with chain-of-custody information and SHA-256 hashes. The software is intended for digital forensic examiners, law-enforcement and legal teams, corporate investigators and other professionals handling authorized device examinations. A free edition supports device detection and inventory checks; the Forensic Edition adds full extraction and reporting. Windows and Linux downloads are offered. It supports examiners who need documented, repeatable workflows for consent-based mobile-device investigations.
Learn more
Pricing
Starting Price:
$0
Pricing Details:
Free to download and use, with no trial period, feature restrictions or license fee.
Free Version:
Free Version available.
Integrations
No integrations listed.
Company Information
Sherlock Forensics
Founded: 2006
Canada
www.sherlockforensics.com/pages/sherlock-disk-imager.html
Videos and Screen Captures
Other Useful Business Software
Ship Agents Faster
Gemini Enterprise Agent Platform lets you rapidly build, scale, govern and optimize production-ready agents grounded in your organization's data. The platform enables developers to build custom or pre-built agents for virtually any use case. New customers get $300 in free credits.
Product Details
Platforms Supported
Windows
Training
Documentation
Support
Phone Support
Online
