SIMPLE IMAGING. FASTEST SPEEDS.

Evimetry Imager is the fastest forensic imager. It provides a fast, simple and safe way to create physical disk images by booting from a USB flash drive or hard drive.

A USB forensic OS based forensic imager.

Evimetry Imager provides fast and simple forensic imaging of Intel Macs & PC’s via a Linux-based Forensic Operating System (the Evimetry Deadboot).

Fast.

Acquire as fast as your hardware is capable of. Using a single USB connected SSD storage drive, acquire at rates of around 20 GB/min. With Imager Multi, image to multiple evidence storage devices at the same time, to reach speeds in the 100’s of GB/min.

Easy to provision.

Create Evimetry Imager USB boot devices with only a few mouse clicks. For large USB disks the remaining space is configured and “Blessed” for storing evidence. Great for low-port count modern laptops.

Foolproof write blocking.

Evimetry Imager automatically manages write blocking, and will only write to evidence storage devices that have been whitelisted or “Blessed” as good for writing to.

Simple, complete imaging.

Evimetry Imager is for simple and foolproof complete acquisitions of a single disk at a time. As such, it doesn’t support Evimetry’s more complex allocated-only and non-linear partial acquisition techniques.

Works with your current toolset.

Evimetry’s AFF4 images are simply consumed using our freely available Filesystem Bridge, and a growing number of commercial and open source tools.

Deadboot acquisition

This tutorial steps you through using Evimetry Imager to acquire the disk of a computer booted from the Evimetry Deadboot.
Learn how to acquire with the Deadboot Imager UI

Usage Videos

Streamlined single computer acquisition with Evimetry Imager

This screencast demonstrates the creation of a combined Evimetry Deadboot/Evidence Storage USB Device, followed by rapid acquisition using Evimetry Imager.