Ftk Imager 3.4.0.1 Work · Original & Exclusive

In version 3.4.0.1, the process of creating these images is streamlined. The investigator simply selects the source (a physical drive or a logical partition), chooses the destination format, and verifies the "Verify images after creation" checkbox. This verification step calculates hash values (MD5 and SHA1) before and after the copy to mathematically prove the copy is identical to the source.

It remains a free, industry-standard tool for creating bit-for-bit forensic copies of drives without altering the original data. Data Leakage Case - CFReDS

The core capability of this tool is creating forensic images of physical drives, logical drives, or specific file folders.

File → Capture Memory