AccessData IMAGER

Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with a forensic tool such as AccessData® Forensic Toolkit® (FTK) is warranted. Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence.

A forensic image is a bit-for-bit copy of a hard drive or other electronic device that can be used to analyze the data without altering the original evidence.

You can mount an image in Imager by clicking File > Image Mounting or by clicking the Image Mounting button on the Toolbar. The image mounting functionality allows you to access the image as a drive in Windows Explorer or other programs.

Click File > Create Disk Image or click the Create Disk Image button in the toolbar. Select whether you want to image a complete drive or partition, specify the location where you want to save the image, and choose a file format.

You can verify the integrity of an image by clicking File > Verify Drive/Image or by clicking the Verify Drive/Image button on the Toolbar. You can also use the /VerifyImage command line option to verify an image from the command line.