Skip to main content

Overview

About FEX Imager™ (free)

A forensic imaging program that will acquire or hash a bit-level forensic image with full MD5, SHA1, SHA256 hash authentication. Acquire a physical drive, logical drive, folders and files, remote devices (using servlet), or re-acquire a forensic image.

Write forensic images files as:

  • DD/RAW (Linux “Disk Dump”)
  • E01
  • L01

Supports none, fast, good or, best compression methods.

Key Features

Acquire

  • Acquire physical, logical, folders and files.
  • Re-acquire existing forensic image files.
  • Supports acquisition from remote devices using the GetData Forensics servlet.
  • Acquire to .E01 or DD format with MD5, SHA1 or SHA256 acquisition hash.
  • Acquire folders and files to L01 format with full MD5, SHA1 or SHA256 file hash.
  • Automatically verify acquisition hash after creation.
  • Image an entire device or set start and end sector positions.
  • Split image files into custom segments with no segment size limit.
  • Option to set device sector size to acquire at 512, 2048, or 4096 sector size.
  • Option to force Windows compliant file names for use with Magnet Forensics products.

Compression

Supports EnCase None, Fast, Good, Best compression settings for E01 and L01 formats.

Case Data

Writes acquisition information within EnCase E01 and L01 formats.

Log

Records a detailed log file including device details and source and verification hash information.

System Requirements

FEX Imager is a 64 bit application.

Minimum recommended system requirements are:

  • i7
  • 16 GB RAM
  • Windows 10

Run as local Administrator to ensure that sufficient access rights are available for access to devices.

FEX Imager does not support the acquisition of HPA or DCO areas (The HPA and DOC are two areas of a hard drive that are not normally visible to an operating system or an end user. Whilst the HPA and DCO are hidden, it is technically possible for a user to access these areas and store/hide data).

Screen Shots

Select source device:

Select destination and enter case details:

Acquire and verify: