Alternatives to Sherlock Forensics Disk Imager
Compare Sherlock Forensics Disk Imager alternatives for your business or organization using the curated list below. SourceForge ranks the best alternatives to Sherlock Forensics Disk Imager in 2026. Compare features, ratings, user reviews, pricing, and more from Sherlock Forensics Disk Imager competitors and alternatives in order to make an informed decision for your business.
-
1
Active@ Disk Image
LSoft Technologies
Active@ Disk Image is a disk image software that makes an exact copy of any PC disk (HDD, SSD, USB, CD, DVD, Blu-ray etc.) and stores it into a folder. The disk images may be used for backups, PC upgrades or disk duplication purposes. In case of computer failure, a backup image may be used to recover your computer system or find & restore any necessary files from within an image. Create & Restore Disk Image Backup (occupied clusters only). Image Compression (Fast, Normal and High). Mounting images as virtual drives. Incremental and Differential images. RAID is supported. Rescue bootable media. Create & restore raw disk image (sector by sector copy). Scheduled backups. Windows Servers are supported. Image Encrypting (AES-128, AES-192, AES-256). Scripting support. E-mail notifications. Cloud storage.Starting Price: $39 one time -
2
DataNumen Disk Image
DataNumen
DataNumen Disk Image is a powerful tool to clone and restore disks or drives. It can create and restore the disk image or drive image byte by byte. Useful for data backup & recovery, disk/drive copy & cloning, and forensic. Support all kinds of disks and drives. Support for Windows and Windows Server. Support to restore image data back to drives. Support to clone data from corrupted media. Support to replace damaged sectors with specified data. Support to clone multiple disks and drives in batch. Ideal to be used as a computer forensic tool and electronic discovery (or e-discovery, eDiscovery) tool. With DataNumen Disk Image, you can create images for drives and disks, for various purposes, such as backup, restore, forensics and data recovery. Before creating drive or disk images with DataNumen Disk Image, please close any other applications. After the clone process, if the image file is created successfully, you will see a message box.Starting Price: $6.95 one-time payment -
3
Sherlock Forensics Recover
Sherlock Forensics
Sherlock Forensics Recover is Windows desktop software for browsing drives and disk images, creating forensic images, and recovering deleted files. It supports Windows 10 and 11 and FAT32, NTFS, exFAT, APFS, HFS+, ext, XFS, Btrfs, and ZFS. Quick and deep scans support signature-based carving, lost-partition searches, and RAID reconstruction. Results are identified as measured from file metadata, located by signature, or placed by assumption; likely overwritten files are flagged. The software creates self-contained offline HTML reports, records SHA-256 hashes, and is designed not to write to the source drive. A free edition is available. The Pro edition is a $295 one-time purchase and adds recovery features and pagefile analysis for URLs, paths, IP addresses, and credentials. It is intended for forensic examiners, IT professionals, and data recovery specialists. The installer is EV-signed and SHA-256 verified.Starting Price: $0 -
4
Android Acquirer
Sherlock Forensics
Android Acquirer is desktop software for consent-based logical acquisition and examination of Android phones and tablets. It connects through Android Debug Bridge (ADB) and a helper application to collect selected device data, including messages, contacts, call records, media, apps and artifacts. Examiners can review extracted records, preserve acquisition details and produce forensic PDF reports with chain-of-custody information and SHA-256 hashes. The software is intended for digital forensic examiners, law-enforcement and legal teams, corporate investigators and other professionals handling authorized device examinations. A free edition supports device detection and inventory checks; the Forensic Edition adds full extraction and reporting. Windows and Linux downloads are offered. It supports examiners who need documented, repeatable workflows for consent-based mobile-device investigations.Starting Price: $399 one-time -
5
Sherlock Forensics iPhone and iPad Analyzer
Sherlock Forensics
Sherlock Forensics iPhone and iPad Analyzer is Windows software for acquiring and examining iPhone and iPad evidence through logical MobileBackup2 backups. It also analyzes Cellebrite UFED and Inseyets full-filesystem extractions created with separate acquisition tools. The application runs fully offline and does not modify evidence. It decrypts encrypted backups and organizes data into more than 200 searchable artifact views for messages, calls, contacts, Safari history, Apple Notes, Maps and other app data. The free edition previews 25% of each artifact view, capped at 100 rows. The Forensic Edition adds unlimited data, global search, CSV and JSON export, a court-ready HTML report, a raw SQLite browser, file extraction and screen capture. It can flag deleted records recovered from the examined data. Users include digital forensic examiners, investigators, law enforcement, legal teams and forensic labs that review and document mobile-device evidence.Starting Price: $599 one-time -
6
LLIMAGER
e-Forensics Inc
LLIMAGER was designed to address the need for a low-cost, no-frills “live” forensic imaging solution for Mac computers, capable of capturing the entirety of a synthesized disk, including volume unallocated space, as macOS sees the disk with its partitions mounted. The application was developed to be user-friendly and easy enough for entry level digital forensics examiners. The application leverages built-in Mac utilities, providing a versatile solution compatible with a wide range of macOS versions, both past and present. This ensures that the tool remains functional across diverse system configurations and updates. FEATURES INCLUDE: Powerful and Fast "Live" imaging, CLI based Application Supports Intel, Apple Silicon, T2 Chips, and APFS File Systems. Full Acquisition Log SHA-256 or MD5 Hashed DMG Images Choice of Encrypted /Decrypted DMGs for use in commercial forensics tools Unlimited Technical SupportStarting Price: $425 -
7
Sherlock Forensics PDF Viewer + Editor
Sherlock Forensics
Sherlock Forensics PDF Viewer + Editor is a downloadable desktop application for examining PDF files in legal, investigative, and security workflows. It provides structural and metadata inspection, panels for reviewing embedded JavaScript, links, launch actions, signatures, and other document properties, plus tools to examine text affected by apparent redactions and identify possible document changes. Users can scan folders of PDFs, compare two documents for structural differences, and generate plain-language case-note summaries. Its workflow separates parser-based inspection from optional visual rendering, which the user starts deliberately. A free edition covers viewing and forensic inspection; a Pro plan is offered for $29 per year. The product is intended for lawyers, paralegals, eDiscovery teams, forensic document examiners, investigators, and security analysts assessing suspicious or evidentiary PDFs.Starting Price: $0 -
8
EnCase Forensic
OpenText
The Gold Standard in Forensic Investigations – including Mobile Acquisition. Improve investigation efficiency with the release of optical character recognition (OCR) support that seamlessly extracts embedded text from scanned images, documents and PDFs as part of the evidence collection workflow. 21.2 also expands social media artifact support and includes an enhanced workflow with a new summary view that allows users to cross-reference disparate artifact types, significantly improving evidence processing workflows. OpenText Security (formerly Guidance Software) created the category for digital investigation software with EnCase Forensic in 1998. EnCase has maintained its reputation as the gold standard in criminal investigations and was named the Best Computer Forensic Solution for eight consecutive years by SC Magazine. No other solution offers the same level of functionality, flexibility, and has the track record of court-acceptance as EnCase Forensic. -
9
DAEMON Tools Pro
DAEMON Tools
DAEMON Tools Pro is known as powerful and professional emulation software to work with disc images and virtual drives. Mount all popular types of images from application or Explorer. Grab images from physical discs with advanced parameters. Mount with double-click or customize the emulation process manually. Attach virtual drives to physical ones and set advanced emulation options. Create a raw disk image from USB device content. Work with USB drives right from Pro. Find more about game images you store and mount. Be in touch with the latest news from gaming industry. Attach virtual drives to physical ones and set advanced emulation options. Convert, compress and protect image files with password. Store all your favorite image files in handy Images catalog. Customize the main window and image editor.Starting Price: $4.51 per month -
10
Passware Kit
Passware
Passware Kit Forensic is the complete encrypted electronic evidence discovery solution that reports and decrypts all password-protected items on a computer. The software recognizes 340+ file types and works in batch mode recovering passwords. Analyzes live memory images and hibernation files and extracts encryption keys for hard disks and passwords for Windows & Mac accounts. Passware Bootable Memory Imager acquires memory of Windows, Linux, and Mac computers. Resolved navigation issues after stopping the password recovery process. Instant decryption of the latest VeraCrypt versions via memory analysis. Accelerated password recovery with multiple computers, NVIDIA and AMD GPUs, and Rainbow Tables. In addition to all the key features of a Windows version, Passware Kit Forensic for Mac provides access to APFS disks from Mac computers with Apple T2 chip.Starting Price: $1,195 one-time payment -
11
Forensic Email Collector
Metaspike
Expertly preserve email evidence without breaking a sweat. Get plug & play output for digital forensic investigations and eDiscovery. We all run into cases where collecting a mailbox as a whole is not an option, often due to privacy or timeframe concerns. On the other hand, eDiscovery and digital forensics workflows often involve a full collection, followed by post-acquisition searches. Forensic Email Collector solves this problem in a creative way. You can perform instant in-place searches on mailboxes on the server before the acquisition and forensically preserve only the search results. No need to create labels, tag documents, or make any changes to the target mailbox. Files attached to emails as hyperlinks to a cloud storage system can throw a monkey wrench into your forensic preservation. The linked attachments often require authentication and are inaccessible unless handled as part of the initial acquisition.Starting Price: $499 one-time payment -
12
R-Drive Image
R-Tools Technology
R-Drive Image is a potent utility providing disk image files creation for backup or duplication purposes. A disk image file contains the exact, byte-by-byte copy of a hard drive, partition or logical disk and can be created with various compression levels on the fly without stopping Windows OS and therefore without interrupting your business. These drive image files can then be stored in a variety of places, including various removable media such as CD-R(W)/DVD, Iomega Zip or Jazz disks, etc. Using R-Drive Image, you can completely and rapidly restore your system after heavy data loss caused by an operating system crash, virus attack or hardware failure. R-Drive Image is one of the best backup and disaster recovery solutions to prevent losing your data after a fatal system failure. Simple wizard interface. Almost all actions can be specified by several mouse clicks, no in-depth computer management skills are required.Starting Price: $44.95 one-time payment -
13
Belkasoft Remote Acquisition
Belkasoft
Belkasoft Remote Acquisition (Belkasoft R) is a new digital forensic and incident response tool developed specifically for remote extraction of hard and removable drives, RAM, connected mobile devices, and even specific types of data. Belkasoft R will be useful in cases when an incident response analyst or a digital forensic investigator needs to gather evidence quickly and the devices in question are situated in geographically distributed locations. With Belkasoft R, there is no longer need to interrupt an employees' daily routine or draw excessive attention to your investigation. Belkasoft R saves your time and money doing a forensically sound remote acquisitions: no more excessive costs and extra time for travels. No more geographical challenges and expensive trips. No need in having trained specialists in all locations of your organization’s offices. -
14
Drive SnapShot
Tom Ehlert Software
Disk Image Backup for Windows. The Backup process will back up all your data into a single file, containing all data, including system data and registry, for total security, should your computer ever crash. There is no restart (to DOS) necessary. The new Snapshot technology ensures that all data are consistent, and reflect the PC's data at the start of backup. There are no difficulties with opened files. This enables a very fast and easy way to back up servers and other computers, that must run 24 hours a day. Drive Snapshot creates a virtual drive, containing all your drive's data. You may use, compare, or restore these files directly from the Disk Image file. This works with any program of your choice, including (of course) the Windows Explorer.Starting Price: $44.37 one-time payment -
15
Belkasoft Triage
Belkasoft
Belkasoft Triage is a new digital forensic and incident response tool developed specifically for a quick analysis of a live computer and making a partial image of important data. Belkasoft T is designed to assist in situations when an investigator or a first responder is at the scene of incident and needs to quickly identify and obtain specific digital evidence stored on a Windows machine. The product is irreplaceable in situations of time pressure, when there is a need to quickly detect presence of specific data and obtain investigative leads instead of conducting an in-depth analysis of all the digital evidence. -
16
Belkasoft X
Belkasoft
Belkasoft X Forensic (Belkasoft Evidence Center X) is a flagship tool by Belkasoft for computer, mobile, drone, car, and cloud forensics. It can help you to acquire and analyze a wide range of mobile and computer devices, run various analytical tasks, perform case-wide searches, bookmark artifacts, and create reports. Belkasoft X Forensic acquires, examines, analyzes, and presents digital evidence from major sources—computers, mobile devices, RAM, cars, drones, and cloud services—in a forensically sound manner. If you need to share the case details with your colleagues, use a free-of-charge portable Evidence Reader. Belkasoft X Forensic works out of the box and can be easily integrated into customer workflows. The software interface is so user-friendly that you can start working with your cases right after the Belkasoft X Forensic deployment.Starting Price: $1500 -
17
Forevid
Forevid
Forevid video analyzer offers options to record screens during forensic analysis of video files. Monitor the complete activity in file format to prevent any alteration of digital evidence during collection and examination. Also, change the “frame rate” of the recording and save it in .avi format. The bookmark option to add information to a specific frame of the input video file for editing resulted in a faster and more efficient investigation. With Forevid forensic video analyzer bookmark the frame as a PDF or copy it to the clipboard to edit with an image editor. Video encoding option to convert video into a compatible format for other video player devices. Select the encoding setting to change the quality of the video while converting it into lossless MP4, MKV FLV, and SFX player (exe) file format.Starting Price: Free -
18
X-Ways Forensics
X-Ways
X-Ways Forensics is an advanced work environment for computer forensic examiners and our flagship product. Runs under Windows XP/2003/Vista/2008/7/8/8.1/2012/10/2016, 32 Bit/64 Bit, standard/PE/FE. (Windows FE is described here, here and here.) Compared to its competitors, X-Ways Forensics is more efficient to use after a while, by far not as resource-hungry, often runs much faster, finds deleted files and search hits that the competitors will miss, offers many features that the others lack, as a German product is potentially more trustworthy, comes at a fraction of the cost, does not have any ridiculous hardware requirements, does not depend on setting up a complex database, etc.! X-Ways Forensics is fully portable and runs off a USB stick on any given Windows system without installation if you want. Downloads and installs within seconds (just a few MB in size, not GB). X-Ways Forensics is based on the WinHex hex and disk editor and part of an efficient workflow model.Starting Price: $18,589 -
19
Amped Authenticate
Amped Software
Amped Authenticate is the leading forensic software for unveiling the processing history of a digital image. Amped Authenticate provides a suite of powerful tools to determine whether an image is an unaltered original, an original generated by a specific device, or the result of manipulation using a photo editing software, making its admissibility as evidence questionable. Amped Authenticate is used by digital forensic experts and intelligence agencies worldwide. Authenticate is a collection of the most useful, real-world-application authentication filters and techniques identified by image analysts, based on hundreds of scientific papers and studies. These have been built into an easy-to-use, yet amazingly powerful interface to help investigators answer the many questions of authenticity and integrity surrounding today's digital images. -
20
ADF Cloud Platform
ADF Solutions
ADF Solutions is the leading provider of digital forensic and media exploitation tools. These tools are used for processing and analyzing Android/iOS smartphones, mobile devices, computers, external drives, drive images, and other media storage (USB flash drives, memory cards, etc.) ADF triage software is all about speed, scalability, ease-of-use, and relevant results. The tools have a proven track record in reducing forensic backlogs, streamlining digital investigations and rapid access to digital evidence and intelligence. Our customers include federal, state and local law enforcement agencies, military and defense agencies, Office of Inspector General offices, Attorneys General, prosecutors, and other investigative professionals worldwide.Starting Price: $35000 -
21
ManageEngine OS Deployer
ManageEngine
ManageEngine OS Deployer is a software program that enables you to deploy operating systems anywhere across the globe. It also functions as a comprehensive hard drive cloning software. It allows you to create a single golden image of the OS and deploy it to desktops and servers from a central location. You can customize the image for deployment according to the organization's department and user roles. This software helps you save time and effort by seamlessly migrating user profiles. It provides reliable and convenient driver management to collect and distribute drivers automatically. You can perform live disk imaging where you can image a machine when it's live and functioning in the network and can also perform offline imaging if needed. You can also deploy OS to multiple machines independent of vendor make or model.Starting Price: $6/Year/Single Workstation -
22
IvyBackup
Kudu Computing Ltd
IvyBackup is a backup tool for Windows that helps you create and automate your backup tasks with more ease than ever before. Enjoy time savings by automating backup compression, encryption, cloud storage uploads, and more. Key Features: ✓ Drive image backups. ✓ Full backups. ✓ Differential backups. ✓ Mirror backups. ✓ Cloud Storage Support. ✓ Windows Explorer Integration. ✓ Import/Export Backup Jobs, Settings, and Backups. ✓ Backup to local and removable disk. ✓ Backup to FTP/FTPS/SFTP. ✓ Backup Encryption support. ✓ Backup notes. ✓ Notification silent mode.Starting Price: $39 -
23
Cognitech FiA 64
Cognitech
FiA is a comprehensive software with analysis tools designed for forensic analysis and authentication of digital images. This extensive toolkit will allow the user to investigate the evidence and detect possible traces of tampering or other types of inconsistencies. FiA is used to systematically detect forged/doctored file based digital image evidence is able to authenticate and uncover where tampering and modification has taken place in a doctored image. This solution allows the expert to prepare everything needed for official court ready reports and all results are based on a forensic scientific methodology. FiA is a proven solution based on years of research. More research is being conducted to further extend software authentication capabilities to video authentication. FiA was developed for Law Enforcement Agencies only. In addition it is not effective to purchase this technology without the associated comprehensive training course. -
24
DAEMON Tools Lite
DAEMON Tools
Imagine sharing files as easily as saying 1, 2, 3. Just pick a file and launch it to any device within the network. At lightning speed. No use of mobile networks. With the greatest security. The most personal application for disk images so far. Install and update without ads. Receive lifetime updates for 3 PCs. Be the first in the support queue. Buy from $5.99, mount images, VHD drives and ZIP files. Create disk images in ISO, MDX, MDS and APE files. Have all your favorite images at your fingertips. DAEMON Tools Lite 10 allows you to mount all known types of disk image files and emulates up to 4 DT + SCSI + HDD devices. It allows you to create images of your optical discs and access them through a well-organized catalog. DAEMON Tools Lite is ideal for working with files you already have and creating new images from optical discs, data files and audio CDs. DAEMON Tools Lite 10 allows you to save and protect your data.Starting Price: $5.99 one-time payment -
25
Falcon Forensics
CrowdStrike
Falcon Forensics offers comprehensive data collection while performing triage analysis during an investigation. Forensic security often entails lengthy searches with numerous tools. Simplify your collection and analysis to one solution to speed triage. Incident responders can respond faster to investigations, conduct compromise assessments along with threat hunting and monitoring with Falcon Forensics. Pre-built dashboards, easy search, and view data capabilities empower analysts to search vast amounts of data, including historical artifacts, quickly. Falcon Forensics automates data collection and provides detailed information around an incident. Responders can tap into full threat context without lengthy queries or full disk image collections. Provides incident responders a single solution to analyze large quantities of data both historically and in real-time to uncover vital information to triage an incident. -
26
DAEMON Tools Ultra
DAEMON Tools
DAEMON Tools Ultra is the most powerful, up-to-date and advanced imaging software ever created. Access a huge list of possibilities to work with virtual drives, create bootable USB sticks to recover operating systems, use RAM disks to speed up your PC and evaluate the incomparable iSCSI Initiator that allows you to connect to USB devices. Mount all types of image files including virtual hard drives and more. Create virtual images of discs, files and audio tracks. Emulate an unlimited number of virtual DT, SCSI, IDE and HDD drives. Edit, convert, compress, split, protect and burn images. Get extra information about the images you mount. Stay informed with the latest gaming industry news. Write boot images to USB sticks in few clicks. Create a fast, reusable and convenient device for OS recovery. Boot with UEFI or BIOS; work with GPT or MBR partitions. Create Live USB devices and cards with the Raspberry Pi OS.Starting Price: €6 per month -
27
ProDiscover
ProDiscover
ProDiscover forensics suite addresses a wide range of cybercrime scenarios encountered by law enforcement and corporate internal security investigators. ProDiscover is widely used in Computer Forensics and Incident Response. The product suite is also equipped with diagnostic and evidence collection tools for corporate policy compliance investigations and electronic discovery. ProDiscover helps in efficiently uncovering files and data of interest. Wizards, dashboards and timeline views help in speedily discovering vital information. Investigators are provided with a wide range of tools and integrated viewers to explore the evidence disks and extract artifacts relevant to the investigation. ProDiscover combines speed and accuracy, with ease of use and is available at an affordable price. Launched in 2001, ProDiscover has a rich history. It was one of the first products to support remote forensic capabilities. -
28
O&O DiskImage
O&O Software
O&O DiskImage 16.5 lets you back up an entire computer or single files whenever you want – even while the computer is being used. In the event you should lose your personal data it can be quickly restored with just a few mouse clicks – even when Windows is no longer able to start. It also supports SSD drives and the latest UEFI System. O&O DiskImage lets you carry out a system restore and to duplicate or clone an entire PC or hard drive. You can even restore this backup onto a computer whose hardware is different from the original machine, for instance, where you have changed a motherboard on the target machine or have bought a brand new PC and want to restore an old backup onto it. A regular backup is still something that many users prefer to avoid. At least that is until they suffer their first loss of important files as a result of software, hardware or user error: that’s when it becomes crystal clear just how valuable a reliable and up-to-date backup really is!Starting Price: $49.95 per PC -
29
Macrium Reflect
Paramount Software
Complete data security is more important than ever. Whether you’re protecting your home or business PCs, Macrium has a range of reliable solutions for you. The complete backup solution for personal use. Protect documents, data and operating systems using advanced disk imaging technology. Includes Macrium viBoot for instant Hyper-V virtualization and Macrium Image Guardian. Your license includes 12 months Essentials Support, giving you complete peace of mind. If you have any issues with Macrium Reflect 8 Home Edition, a member of our technical team will be happy to assist. Sit back, relax, and be confident that Macrium quickly and reliably secures your valuable data. Mount images in Windows Explorer for easy item level recovery. Rapid Delta Restore recovers your images in minutes or even seconds. Restore images to dissimilar hardware using Macrium ReDeploy (Not included in the 30-Day Trial). Protect your backups from ransomware with Macrium Image Guardian. -
30
Forensic Explorer
GetData Forensics
Suitable for new or experienced investigators, Forensic Explorer combines a flexible and easy to use GUI with advanced sort, filter, keyword search, data recovery and script technology. Quickly process large volumes of data, automate complex investigation tasks, produce detailed reports and increase productivity. Access all areas of physical or imaged media at a file, text, or hex level. View and analyze system files, file and disk slack, swap files, print files, boot records, partitions, file allocation tables, unallocated clusters, etc. Inbuilt data carving tool to carve more than 300 known file types. Sort and multiple sort files by attribute, including, extension, signature, hash, path and created, accessed and modified dates. Navigate a disk and its structure via a graphical view. Zoom in and out to graphically map disk usage. Access and analyze data at a text or hexadecimal. Automatically decode values with the data inspector.Starting Price: $1,695 one-time payment -
31
Autopsy
Basis Technology
Autopsy® is the premier end-to-end open source digital forensics platform. Built by Basis Technology with the core features you expect in commercial forensic tools, Autopsy is a fast, thorough, and efficient hard drive investigation solution that evolves with your needs. Tens of thousands of law enforcement and corporate cyber investigators around the world use Autopsy. Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Everyone wants results yesterday. Autopsy runs background tasks in parallel using multiple cores and provides results to you as soon as they are found. It may take hours to fully search the drive, but you will know in minutes if your keywords were found in the user's home folder. See the fast results page for more details. -
32
DriveImage XML
DriveImage XML
Backup logical drives and partitions. Create "hot images" of your drives, while working with them. Copy one drive to another. Easily browse images. DriveImage XML is an easy to use and reliable program for imaging and backing up partitions and logical drives. Image creation uses Microsoft's Volume Shadow Services (VSS), allowing you to create safe "hot images", even from drives currently in use. Images are stored in XML files, allowing you to process them with 3rd party tools. Never again be stuck with a useless backup! Restore images to drives without having to reboot. DriveImage XML is now faster than ever, offering two different compression levels. DriveImage XML runs under Windows XP and up. The program will backup, image and restore drives formatted with FAT and NTFS. We offer two versions of DriveImage XML, a free one for home users, and a paid one for commercial users. Private home users are allowed to use the Private Edition of DriveImage XML without charge.Starting Price: $100 per year -
33
Animetrics
Animetrics
Advanced investigative facial recognition solution for law enforcement and forensic investigators. Convert 2D images into 3D avatars for facial feature superimposition. FaceR Identity Management Solution, a centralized storage and management system for advanced 3D facial recognition powered by Animetrics' FaceR technology. Law enforcement officials, forensic investigators and security personnel have a pressing need to resolve suspects' identities from any kind of photographic evidence that captures an image of a suspects face including video surveillance cameras. ForensicaGPS, the new biometric solution from Animetrics, allows officers to identify individuals from low-resolution photos or video. ForensicaGPS features advanced facial recognition technology designed to increase the speed and enhance the accuracy of criminal investigations. The key to ForensicaGPS' accuracy is the software's ability to convert two-dimensional facial images into three-dimensional avatars. -
34
Amped FIVE
Amped Software
Amped FIVE is the most complete image and video forensics software, acclaimed for its reliability and workflow efficiency. Amped FIVE was designed to answer the need to provide solid, scientific-based forensic image and video enhancement for worldwide legal systems. Image and video analysts worldwide have contributed to the development of the software used today, ensuring all aspects of the investigation process can be completed within a single application. Developed specifically for forensics, public safety, and national security, this all-in-one solution has more than 140 filters and tools, to convert, process, enhance, analyze, present, and document images and videos. It supports any type of image and video data retrieved from various multimedia sources (including audio streams) from CCTV and DVR systems, body-worn cameras, dash cameras, drones, mobile phones, fingerprints, documents, and much more. -
35
Paragon Drive Copy Professional
Paragon Software
Migrate your data or home OS, from any source to any target. Available as part of Hard Disk Manager! Create backups, manage partitions, migrate data. Migrate the OS to a new PC, start working right away. Clone your OS to a USB flash drive and use it anywhere. Keep your disk properly organized, create backups and migrate data with ease. Clone your hard disk to a larger drive, migrate your laptop to a new hard drive. Copy or restore data to a hard disk with a different sector size. Migrate Windows to new storage devices, backup and restore the system and data. Full range of copy operations, copy hard disk entirely or a partition separately. Copy or restore the contents of a 512-byte hard disk to a 4k hard disk with no extra actions required. Migrate any Windows OS from Windows 7 onwards, from HDD to a high-performance SSD. Exclude data you don’t want to copy. Perform partitioning operations to keep disks properly organized.Starting Price: $79.95 one-time payment -
36
UUbyte ISO Editor
UUbyte
UUByte ISO Editor is the best tool for creating Windows bootable USB on macOS. The best thing about this app is that it can split the large install.wim file (> 4GB) by default. This is the most challenging part of making Windows 10/11 installation USB on Mac. In addition, ISO Editor is fully compatible with Intel and Apple Silicon Mac, including M1 and M2 chips. Currently, this app is working perfectly on the latest macOS, including Sonoma, Ventura, Monterey, Big Sur, Catalina and more. ISO burning is one of the most anticipated features of UUbyte ISO Editor. It allows users to directly burn ISO archives to an external media device, including a USB flash drive, CD, and DVD. The best part of this program is that it can make bootable disks from ISO images so you can use it to rescue the computer or fix system issues.Starting Price: $29.95 one-time payment -
37
EaseUS Partition Master
EaseUS
Easily create and modify partitions with this disk partitioning software. Trusted by 60,000,000 loyal customers all over the world. This tool is designed for all computer users, home, business, and service providers. The free partition manager tool covers your basic partitioning requests. Full-featured partition manager utility enables you to operate primary and advanced partition functions and maximize disk capacity usage. Reallocate disk space for better-organized business data and Simplify IT disk management. Convert the system hard drive to a GPT disk before updating to new latest Windows OS. Migrate all the data, applications, and accounts to your new Windows 11 PC. Create an ideal disk layout and keep your PC/server running at its best with EaseUS Partition Master. Methods to increase C drive space step by step. You can apply the desired solution to extend the local C drive or add free space to local disk C.Starting Price: $54.95 per year -
38
OSForensics
PassMark Software
Extract forensic data from computers, quicker and easier than ever. Uncover everything hidden inside a PC. Discover relevant data faster through high performance file searching and indexing. Extract passwords, decrypt files and recover deleted files quickly and automatically from Windows, Mac and Linux file systems. Identify evidence and suspicious activity through our hash matching and drive signature analysis features. Identify and analyze all files and even automatically create a timeline of all user activity. 360° Case Management Solution. Manage your entire digital investigation with OSF’s new reporting features. Build custom reports, add narratives and even attach your other tools’ reports to the OSF report. Volatility Workbench is a graphical user interface (GUI) for the Volatility tool. OSForensics courses offered to suit a diverse range of users and skill sets. Write an image concurrently to multiple USB Flash Drives.Starting Price: $799 per user per year -
39
We are the creators of Virtual Forensic Computing (VFC). This world-renowned software enables Digital Forensic Investigators to view a suspect’s machine in its native environment without turning the original device on, therefore preserving crucial metadata. Widely used by various law enforcement agencies all over the world, VFC is ‘an essential tool’ in every Computer Forensic Investigator’s toolbox. Founded in 2003 by a former Head of the Digital Forensics Unit of the National Crime Squad, MD5 LTD is a UK leading provider of Digital forensics & eDiscovery services. Our digital investigation services are widely used by various organizations including corporate businesses, law enforcement, and government agencies, the legal sector, forensic accountants, and insolvency practitioners. MD5’s forensic laboratory continues to investigate the business world’s ever-changing digital environment.Starting Price: $1000 per year
-
40
Binalyze AIR
Binalyze
Binalyze AIR is a market-leading Digital Forensics and Incident Response platform that allows enterprise and MSSP security operations teams to collect full forensic evidence at speed and scale. Our incident response investigation capabilities such as triage, timeline and remote shell help to close down DFIR investigations in record time. -
41
LiveWire
BlueCat
LiveWire is a high-performance network packet-capture and forensic-analysis platform that captures and stores detailed packet data across physical, virtual, on-premises, and cloud networks. It is designed to give Network-Ops and Security teams deep visibility into network traffic, from data centers to SD-WAN edges, remote sites, and cloud environments, filling in the blind spots left by telemetry-only monitoring. LiveWire delivers real-time packet capture that can be selectively stored and analyzed with advanced workflows, visualizations, and correlation tools; it can automatically detect encrypted traffic and store only what’s needed (headers or metadata), saving disk space while preserving forensics data. It supports “intelligent packet capture,” converting packet-level data into enriched flow-based metadata (called LiveFlow), which can feed into the companion monitoring platform BlueCat LiveNX. -
42
4n6 DBX Forensics Wizard
4n6Soft
4n6 DBX Forensics Software helps investigators to analyze and examine DBX files without Outlook Express in detail. With DBX File Forensics Software, you can extract DBX data to several popular file formats and email services. The software provides DBX file preview in 4 different modes: Content, Attributes, Message Headers, and Hexadecimal View Attributes. To explore DBX files with the software GUI, the software provides two modules: Folder Selection and File Selection. Select File allows you to search only a single file, while Select Folder allows you to search a folder containing multiple DBX files. This DBX Forensics Software can save evidence of DBX files to multiple destinations like email files (DBX files can be preserved as PST files EML files and MBOX files), document files (DBX files can be preserved as PDF, HTML text and emails). It helps in extracting and preserving.Starting Price: $49 -
43
Trimble Forensics Capture
Trimble
Day or night, in good weather or bad, the field software that is at your side. Trimble Forensics Capture is designed for the forensic investigator, with wizard guided workflows, to make data collection and scene mapping efficient and reduce time on scene. Forensics Capture software is a powerful yet intuitive data collector software that simplifies scene evidence gathering and enables a seamless transition to Trimble Forensics Reveal desktop software for in-depth analysis. Capture enables workflows that are smooth, simple and easy to manage. In the field, you can see a diagram of your scene as you shoot it—in 2D or 3D, from any angle—and quickly zoom-in on evidence-rich areas. And, by adding notes and photos to your points, your work back in the office becomes easier and more productive. -
44
E3:Universal
Paraben Corporation
Don’t get caught up in tools that are unmanageable. The E3 Platform gets you processing all types of digital evidence quickly with an Easy interface, Efficient engines, and Effective workflow. E3:UNIVERSAL version that is designed to do all data types from hard drive data, smartphones, and IoT data. The need to change around your tool based on what type of digital data you have is a thing of the past. The E3 Forensic Platform seamlessly adds a large variety of evidence into a single interface to be able to search, parse, review and report on the digital data from most digital sources. Computer forensics focuses on bits and bytes of the file system that holds a large variety of different valuable pieces of data that can be the key to your investigation. From the FAT files systems of old to modern file systems like Xboxes, the E3 Forensic Platform works with the powerhouse of multi-tasking analysis engines to breakdown the data.Starting Price: $6,295 -
45
Axon Investigate
Axon
Improper playback software can alter video evidence and impede investigations. Axon Investigate allows you to review footage from more third-party proprietary video formats than any other solution on the market and provides immediate access to original metadata including date, time, image numbers, etc. More than 80% of investigations involve video evidence. Axon Investigate dramatically improves the video investigation process, saving officers up to 10 hours per week by providing simple, fast and repeatable workflows. Manage and organize hundreds of video sources into one project, track activity, tag relevant events, extract available video and create court-ready deliverables in standard, lossless formats. Axon Investigate is built by a team of certified, forensic video analysts and ensures that investigators view original video evidence and share accurate copies ready for court. -
46
PCVITA Outlook PST Repair
PCVITA Software
Planning for a cloud migration yourself? We would recommend you talk to our migration experts before doing anything. With the technical Know-How in our pocket, we can make your cloud migration experience a breeze. Cloud changes the way how we work and made our job easy. So, as per our motto says “Simplifying Technology”, we are providing cloud hosting to make your daily life as easy as we can. Now, we have over 8000+ satisfied clients, 35M+ server deployments, and 99.995% uptime. MailXaminer being our elite product in the Digital Forensics sector, we also provide various number of viewers that help investigation officers to open and read email messages for in-depth analysis. We are also working with many forensic agencies as well. We provide numerous solutions to these agencies so that they can examine the evidences with proper tools. The tool got updated with latest set of features and additional security parameters.Starting Price: $49 one-time payment -
47
Velociraptor
Rapid7
At the press of a (few) buttons, perform targeted collection of digital forensic evidence simultaneously across your endpoints, with speed and precision. Continuously collect endpoint events such as event logs, file modifications and process execution. Centrally store events indefinitely for historical review and analysis. Actively search for suspicious activities using our library of forensic artifacts, then customize to your specific threat-hunting needs. It was developed by Digital Forensic and Incident Response (DFIR) professionals who needed a powerful and efficient way to hunt for specific artifacts and monitor activities across fleets of endpoints. Velociraptor provides you with the ability to more effectively respond to a wide range of digital forensic and cyber incident response investigations and data breaches. -
48
SmartDeploy
SmartDeploy
SmartDeploy is a leading provider of modern endpoint management solutions. With a flexible layered architecture, IT can achieve centralized, single-image management to support 50 - 50,000 endpoints. SmartDeploys award-winning technology combines the best of progressive solutions like SCCM, centralized solutions like VDI and legacy imaging solutions like Ghost, without the common drawbacks. More than 3,000 organizations trust SmartDeploy to deploy and manage their end user devices. With over 1500 ready-to-use driver packs from top manufacturers, SmartDeploy helps streamline your disk cloning for remote and in-house employees.Starting Price: $1020/50 machines -
49
TRIS
HOBBIT Imaging Solutions
TRIS is a case management & analysis system that is currently in use by the Forensic and Tactical investigation department of the Dutch national police. Forensic Investigators collect information and evidence from a crime scene. This information can often be correlated and combined with existing knowledge and information from other crime scenes. All coherent information must be presented to other units and staff to create a basis for further investigation and actions. With TRIS this information can be analysed such that relationships become clear and previously concealed structures or clusters are revealed. TRIS supports the entire Forensic Intelligence cycle, from initial consolidation of evidence and information, through analysis and smart data-linking, to presentation of the results, all in a single system. -
50
BitVare MBOX Converter
BitVare Software
MBOX Converter is capable to convert MBOX files from 20+ email clients. One can Convert bulk MBOX Files to PST, PDF, HTML, EML, MSG, EMLX, IMAP, etc. MBOX Converter provides multiple data preview options that will help its users in forensic and litigation purposes. MBOX Converter also calls a Forensic MBOX viewer and help users investigate MBOX file deeply. MBOX Converter perfectly works for digital forensic purposes. Also, provide the option to export directly MBOX files to Office 365, Gmail, Outlook.com, Thunderbird, etc. Maintain email's original formatting and folder structure after the MBOX File Conversion. The tool is well designed with an innate viewer option that helps users to preview email and their attached documents before the conversion. It will provide you Hex View and Raw View for examining MBOX Files for digital investigation.Starting Price: $29 one-time payment
