//GetData Forensic Imager

GetData Forensic Imager

Forensic Imager is a Windows based program that will acquire, convert, or verify a forensic image in one of the following common forensic file formats:

  • DD /RAW (Linux “Disk Dump”)
  • AFF (Advanced Forensic Format)
  • E01 (EnCase®)


To download GetData Forensic Imager:

Download GetData Forensic Imager

  • Click the “Download” button below and download “ForensicImager-Setup.exe” to your computer.
  • Run “ForensicImager-Setup.exe” and follow the on screen installation instructions.

Update Log

10-Sep-12 v1.1.0.146

  • Added option to select hash type in verify mode

feature line gif

Program Functions:

GetData Forensic Imager provides three separate functions:

  • Acquire: The acquire option is used to take a forensic image (an exact copy) of the target media into an image file on the investigators workstation;
  • Convert: The convert option is used to copy an existing image file from one image format to another, e.g. DD to E01;
  • Hash or verify: The hash or verify option is used to calculate a hash value, MD5, SHA1 or SHA256, for a device or an existing image file.

Includes the option to SHA256 sector hash a device so that known sectors can be located within an image files (e.g. a single sector of a jpeg file left in unallocated clusters can be identified by its sector hash).

Records a detailed log file including source and verification hash information for each image taken.

feature line gif

System Requirements

Forensic Imager should be run as local Administrator to ensure that sufficient access rights are available for access to devices.

Forensic Imager uses EnCase® v6 E01 format. Images independently verified with EnCase® should be done using V6 or above.

Forensic Imager does NOT support DOS acquisition. If acquisition from a DOS boot disk is required alternative forensic acquisition software should be used.

Forensic Imager does not currently support the acquisition of HPA or DCO areas. The HPA and DOC are two areas of a hard drive that are not normally visible to an operating system or an end user. Whilst the HPA and DCO are hidden, it is technically possible for a user to access these areas and store/hide data.

feature line gif

How to recover?

  • Forensic Imager Options: Acquire, Convert of Verify and image file
  • Forensic Imager Source: Select the source device or image file
  • Forensic Imager Destination: Select the destination and image options
  • Progress and Event log


There are no reviews yet.

Be the first to review “GetData Forensic Imager”

Your email address will not be published. Required fields are marked *