EnCase Forensic Imager is a standalone product and does not require an EnCase Forensic license; there is no cost to download and use.
EnCase Forensic Imager may be used to acquire entire volumes (Ex01/E01) or selected individual folders/files (Lx01/L01).
Users can acquire local drives, but not user-mapped network drives. Acquisition of user-mapped network drives is recommended from the source server itself.
No install is required; files associated with the program are loaded into the User Data directory.
Strong AES 256-bit encryption is provided to protect Lx01 and Ex01 files.
EnCase Forensic Imager is trusted; it uses the same trusted acquisition available in EnCase itself.
EnCase Forensic Imager is familiar; it uses the same interface as EnCase; it functionally behaves like EnCase Forensic in Acquisition Mode.
EnCase Forensic Imager is flexible; it can be used to acquire disks and logical evidence, but also may be used to view and browse existing evidence files, including folder structures and file metadata.
EnCase Forensic Imager is NOT an analysis tool; no search, filtering or analysis capability is available. EnCase Forensic Imager is suited for acquiring files when time is limited and evidence protection is a must. EnCase Forensic Imager enables strong encryption of acquired evidence files, protecting evidence from unintended recipients.
EnCase Forensic Imager can be deployed to a USB stick and used to perform acquisition of a live device.