OSFClone – Open Source Utility To Create And Clone Forensic Disk Images

0
5
OSFClone - Open Source Utility To Create And Clone Forensic Disk Images

OSFClone is a free, self-booting answer which lets you create or clone actual uncooked disk pictures rapidly and unbiased of the put in working system. In addition to uncooked disk pictures, OSFClone additionally helps imaging drives to the open Advance Forensics Format (AFF), AFF is an open and extensible format to retailer disk pictures and related metadata, and Expert Witness Compression Format (EWF). An open customary allows investigators to rapidly and effectively use their most popular instruments for drive evaluation. After creating or cloning a disk picture, you’ll be able to mount the picture with PassMark OSFMount earlier than conducting evaluation with PassMark OSForensics™.

OSFClone creates a forensic picture of a disk, preserving any unused sectors, slack area, file fragmentation and undeleted file data from the unique onerous disk. Boot into OSFClone and create disk clones of FAT, NTFS and USB-linked drives! OSFClone will be booted from CD/DVD drives, or from USB flash drives.

OSFClone can create disk pictures within the dc3dd format. The dc3dd format is good for laptop forensics as a consequence of its elevated stage of reporting for progress and errors, and talent to hash information on-the-fly.

Verify {that a} disk clone is similar to the supply drive, through the use of OSFClone to check the MD5 or SHA1 hash between the clone and the supply drive. After picture creation, you’ll be able to select from a variety of compression choices to scale back the dimensions of the newly created picture, growing portability and saving disk area.

Use OSFClone to save forensic meta-knowledge (comparable to case quantity, proof quantity, examiner identify, description and checksum) for cloned or created pictures.

MoreTip.com

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.