There are several imaging products in the computer forensics market that work on Window such as EnCase, Paraben, and WinHex, however the most versatile and best value for money is FTK Imager, by Access Data. It has several benifits over its rivals, including:
- FTK imager is free. Which makes it excellent value for money. EnCase does not need a dongle to image, but you cannot preview the data without a dongle, unlike FTK Imager.
- FTK Imager is able to create differnet image formats: EO1, DD, or SMART.
- Its able to image drives, but also aquire files or folders (uses its AD1 format, similar to the EnCase LO1 format)
- It can preview the data
- It produces a simple text log of its action
- It can run from a USB drive, without being installed. Excellent for aquiring data from servers.
It is the high quality of tools like this that made the launch of FTK 2 so dissapointing.