ADVANCED IMAGING. FASTEST SPEEDS.
Evimetry Advanced Imager provides a flexible toolkit for live analysis and acquisition of physical disks, booting from a USB flash drive or hard drive.
Product Overview
All the features of Imager and more.
In addition to all the features of Evimetry Imager, the Advanced Imager provides advanced acquisition techniques enabling prioritised evidence acquisition live analysis. The resulting physical images are still usable in regular forensic tools.
Complete, live & profile based acquisitions.
Evimetry’s technical advance is the non-linear partial physical forensic image. Acquire the highest-value evidence by category first, widen the scope of acquisition by live analysis via virtual disk, or take a complete image. The choice is yours.
Allocated only acquistions.
Allocated only acquisitions enable rapid acquisition of all allocated volume and filesystem metadata and content. Useful for acquiring high value content in time critical situations.
Remote control of acquisition.
Scale to acquiring multiple devices at the same, with centralised control from a single pane.
Analyse immediately.
Evimetry closes the gap between acquisition and analysis, with examination and triage activities to occurring at the same time as acquisition. Leverage your preferred forensic toolset for live analysis and triage while you acquire, via a virtual disk device view of your live acquisition.
Tutorials
Remote deadboot acquisition
This tutorial steps you through using Evimetry Advanced Imager to acquire the disk of a computer booted from the Evimetry Deadboot. The acqusition is controlled remotely, using the Evimetry Controller.
Learn how to acquire remotely with the Deadboot
Usage Videos
Profile based acquisition with Evimetry Collector.
This screencast demonstrates the creation and use of a single disk Collector, configured to acquire a partial physical image of log files, pictures, office documents, windows artefacts, and the remainder of the disk by priority. Despite the acquisition being stopped part way through, the resulting image is still usable with regular forensic tools.
