About FEX Imager™ (free)
A forensic imaging program that will acquire or hash a bit-level forensic image with full MD5, SHA1, SHA256 hash authentication. Acquire a physical drive, logical drive, folders and files, remote devices (using servlet), or re-acquire a forensic image.
|Write forensic images files as:
Supports none, fast, good or, best compression methods.
- Acquire physical, logical, folders and files.
- Re-acquire existing forensic image files.
- Supports acquisition from remote devices using the GetData Forensics servlet.
- Acquire to .E01 or DD format with MD5, SHA1 or SHA256 acquisition hash;
- Acquire folders and files to .L01 format with full MD5, SHA1 or SHA256 file hash.
- Automatically verify acquisition hash after creation.
- Image and entire device or set start and end sector positions.
- Split image files into custom segments not no segment size limit.
- Option to set device sector size to acquire at 512, 2048, or 4096 sector size.
- Option to force windows complaint file names for use with Magnet Forensics products.
Supports EnCase None, Fast, Good, Best compression settings for E01 and L01 formats.
Writes acquisition information in within EnCase E01 and L01 formats.
Records a detailed log file including device details and source and verification hash information.
FEX Imager is a 64 bit application.
Minimum recommended system requirements are:
- 16 GB RAM
- Windows 10
Run as local Administrator to ensure that sufficient access rights are available for access to devices.
FEX Imager does not support the acquisition of HPA or DCO areas (The HPA and DOC are two areas of a hard drive that are not normally visible to an operating system or an end user. Whilst the HPA and DCO are hidden, it is technically possible for a user to access these areas and store/hide data).
Select source device:
Select destination and enter case details:
Acquire and verify: