All areas outside the active partitions. Our Legal Disk Imager creates an exact replica of the original media of the target, or suspect machine. The process of imaging will not alter any information on the target machine. The normal procedure of taking the image to WORM media allows the investigator to search for evidence without jeopardising the integrity of the original data. The Legal Disk Imager will automatically take two images to separate WORM media and perform a compare to ensure that a verified image has been taken.
Options are also available to perform a full extraction of files from the image if required.
Once the processing has taken place full searches of all areas of the disk takes only seconds. Multiple searches for any combination of characters can be made. Frequently used words may also be set up as a library under a 'group' name for enhanced searching. Postcodes or phone numbers can be identified easily. The investigation utility, GenTree, incorporates 'Quick View Plus' to view over 200 file formats.