X-Ways Imager: Best speed, most intelligent compression, not free

Dongle-based forensic disk imaging tool. Stripped down version of the X-Ways Forensics computer forensics software with just the disk imaging functionality. Originally introduced in 2009 based on a request from an agency in the US, which had found out during performance tests that X-Ways Forensics was much faster than other imaging tools, especially when used together with hardware write blockers. Another test run by a similar agency in Australia also confirmed significant speed advantages over competing product. November 28, 2011: X-Ways Forensics/X-Ways Imager proved to be around twice as fast as competing products (the usual suspects) in a test ran by the F-Response development team for remote acquisitions! (blog post) July 14, 2013: X-Ways Forensics/X-Ways Image was twice or 3 times as fast as the competing products here.

It is possible to later upgrade a license for X-Ways Imager to X-Ways Forensics, and the dongle can be remotely reprogrammed with an activation code.

The intelligence of the compression and options such as exclusion of free drive space and reverse imaging make X-Ways Forensics (and now X-Ways Imager) the perhaps best disk imaging software on the market. The algorithms in use in X-Ways Forensics and X-Ways Imager offer a great dynamic compromise between speed and compression rate and when reasonable avoid the decompression performance penalty when working with the image after its creation, unlike some really bad other disk imaging tools that waste your time and use compression blindly and shall not be named here. Plus X-Ways Imager can reconstruct virtually all conceivable variants of failed disk-based RAID systems like JBOD, RAID 0, RAID 5, RAID 6 and more if you know the correct parameters, and can image or clone the RAID.

The following menu commands in the software are available:

• Tools | Open Disk

• File | Create Disk Image (except for the ability to omit hidden files)

• Tools | Disk Tools | Clone Disk

• Specialist | Reconstruct RAID System

The contents of the sectors are displayed in a hex and a text column. The directory browser shows the partitions on physical disks. You can image or clone entire physical disks or individual partitions, i.e. copy them sector-wise, and create either raw images or .e01 evidence files. The so-called technical details report is output at that occasion, too. You can convert images from one format to the other. Free space can be omitted optionally if you don't need to acquire it, to save a lot of time and drive space. Raw images can additionally be filled backwards if you are struggling with severely damaged hard disks that freeze or crash your computer when reaching a certain sector. Detection and acquisition of HPA or DCO areas supported. Almost all other functions and display elements known from X-Ways Forensics are grayed out/not available in X-Ways Imager. In particular X-Ways Imager cannot create evidence file containers or skeleton images or cleansed images.

F-Response is an ideal add-on product that allows X-Ways Forensics to remotely analyze disks and RAM. And the other way around X-Ways Imager is an ideal add-on product for F-Response that allows you to image remote disks and dump remote RAM, too!

Screenshot of X-Ways Imager