FEX Imager

A forensic imaging program that will acquire or hash a bit-level forensic image with full MD5, SHA1, SHA256 hash authentication. Acquire a physical drive, logical drive, folders and files, remote devices (using servlet), or re-acquire a forensic image.

Are you interested in this product?

1300 55 33 24

contact@cdfs.com.au

Quote Request

About FEX Imager™ (free)

 

FEX Imager
FEX Imager
FEX Imager

 

A forensic imaging program that will acquire or hash a bit-level forensic image with full MD5, SHA1, SHA256 hash authentication. Acquire a physical drive, logical drive, folders and files, remote devices (using servlet), or re-acquire a forensic image.

 

Write forensic images files as:

 

  • DD/RAW (Linux “Disk Dump”)
  • E01
  • L01

 

Supports none, fast, good or, best compression methods.

 

 

Key Features

 

Acquire

 

  • Acquire physical, logical, folders and files.
  • Re-acquire existing forensic image files.
  • Supports acquisition from remote devices using the GetData Forensics servlet.
  • Acquire to .E01 or DD format with MD5, SHA1 or SHA256 acquisition hash.
  • Acquire folders and files to L01 format with full MD5, SHA1 or SHA256 file hash.
  • Automatically verify acquisition hash after creation.
  • Image an entire device or set start and end sector positions.
  • Split image files into custom segments with no segment size limit.
  • Option to set device sector size to acquire at 512, 2048, or 4096 sector size.
  • Option to force Windows compliant file names for use with Magnet Forensics products.

 

Compression

 

Supports EnCase None, Fast, Good, Best compression settings for E01 and L01 formats.
 

Case Data

 

Writes acquisition information within EnCase E01 and L01 formats.
 

Log

 

Records a detailed log file including device details and source and verification hash information.

 

System Requirements

 

FEX Imager is a 64 bit application.

 

Minimum recommended system requirements are:

 

  • i7
  • 16 GB RAM
  • Windows 10

 

Run as local Administrator to ensure that sufficient access rights are available for access to devices.

 

FEX Imager does not support the acquisition of HPA or DCO areas (The HPA and DOC are two areas of a hard drive that are not normally visible to an operating system or an end user. Whilst the HPA and DCO are hidden, it is technically possible for a user to access these areas and store/hide data).