About FEX Imager™ (free)
A forensic imaging program that will acquire or hash a bit-level forensic image with full MD5, SHA1, SHA256 hash authentication. Acquire a physical drive, logical drive, folders and files, remote devices (using servlet), or re-acquire a forensic image.
Write forensic images files as:
- DD/RAW (Linux “Disk Dump”)
- E01
- L01
Supports none, fast, good or, best compression methods.
Key Features
Acquire
- Acquire physical, logical, folders and files.
- Re-acquire existing forensic image files.
- Supports acquisition from remote devices using the GetData Forensics servlet.
- Acquire to .E01 or DD format with MD5, SHA1 or SHA256 acquisition hash.
- Acquire folders and files to L01 format with full MD5, SHA1 or SHA256 file hash.
- Automatically verify acquisition hash after creation.
- Image an entire device or set start and end sector positions.
- Split image files into custom segments with no segment size limit.
- Option to set device sector size to acquire at 512, 2048, or 4096 sector size.
- Option to force Windows compliant file names for use with Magnet Forensics products.
Compression
Supports EnCase None, Fast, Good, Best compression settings for E01 and L01 formats.
Case Data
Writes acquisition information within EnCase E01 and L01 formats.
Log
Records a detailed log file including device details and source and verification hash information.
System Requirements
FEX Imager is a 64 bit application.
Minimum recommended system requirements are:
- i7
- 16 GB RAM
- Windows 10
Run as local Administrator to ensure that sufficient access rights are available for access to devices.
FEX Imager does not support the acquisition of HPA or DCO areas (The HPA and DOC are two areas of a hard drive that are not normally visible to an operating system or an end user. Whilst the HPA and DCO are hidden, it is technically possible for a user to access these areas and store/hide data).
