X-Ways
Imager: Best speed, most intelligent compression, not free

Dongle-based
forensic disk imaging tool. Stripped down version of
the
X-Ways
Forensics computer forensics software with just the disk imaging functionality. Originally introduced in 2009 based on a request from an agency
in the US, which had found out during performance tests that X-Ways
Forensics was much faster than other imaging tools, especially when used
together with hardware write blockers. Another test run by a similar
agency in Australia also confirmed significant speed advantages over
competing product. November 28,
2011: X-Ways Forensics/X-Ways Imager proved to be around twice as
fast as competing products (the usual suspects) in a test ran by the F-Response
development team for remote acquisitions! (blog
post) July 14, 2013: X-Ways Forensics/X-Ways Image was twice
or 3 times as fast as the competing products
here.
It is possible to later upgrade a
license for X-Ways Imager to X-Ways Forensics, and the
dongle can be remotely reprogrammed with an activation code.
The intelligence of the
compression and options such as exclusion of free drive space and
reverse imaging make X-Ways Forensics (and now X-Ways Imager) the
perhaps best disk imaging software on the market. The algorithms in
use in X-Ways Forensics and X-Ways Imager offer a great dynamic
compromise between speed and compression rate and when reasonable
avoid the decompression performance penalty when working with the
image after its creation, unlike some really bad other disk imaging tools
that waste your time and use compression blindly and shall not be named here. Plus X-Ways Imager can
reconstruct virtually all conceivable variants of failed disk-based
RAID systems like JBOD, RAID 0, RAID 5, RAID 6 and more if you know
the correct parameters, and can image or clone the RAID.
The following menu
commands in the software are available:
-
Tools
| Open Disk
-
File | Create Disk Image
(except for the ability to omit hidden files)
-
Tools | Disk Tools | Clone Disk
-
Specialist | Reconstruct RAID
System
The contents of the sectors are
displayed in a hex and a text column. The directory browser shows
the partitions on physical disks. You can image or clone entire
physical disks or individual partitions, i.e. copy them sector-wise,
and create either raw images or .e01 evidence files. The so-called
technical details report is output at that occasion, too. You can
convert images from one format to the other. Free space
can be omitted optionally if you don't need to acquire it, to save a
lot of time and drive space. Raw images can additionally be filled
backwards if you are struggling with severely damaged hard disks
that freeze or crash your computer when reaching a certain sector.
Detection and acquisition of HPA or DCO areas supported. Almost all other functions and display elements
known from X-Ways Forensics are grayed
out/not available in X-Ways Imager. In particular X-Ways Imager
cannot create evidence file containers or skeleton images or cleansed images.
F-Response is
an ideal add-on product that allows X-Ways Forensics to remotely
analyze disks and RAM. And the other way around X-Ways Imager is an ideal add-on product
for F-Response that allows you to image remote disks and dump remote
RAM, too!
Screenshot of X-Ways Imager
|