3

I am looking for a free computer forensics software like Guidance Encase.

The software must

  • collect data / capture disk images (> 2 TB)
  • open dd-style files
  • process the collected data
    • especially search for deleted and recycled files
    • find files by file name pattern / extension
    • optional: find files by date / size / attributes / ACLs
  • be gratis
  • run on Windows 7 (x64)
3

TestDisk should be your candidate:

  • collect data / capture disk images: Yes (I don't know of a size limit)
  • open dd-style files: Yes (that's what I used if for often; it analyzes the structure and, when in doubt, asks you for partition types etc.)
  • process the collected data: Sure (wouldn't make sense otherwise). You can even extract selected information, browse through directories, and more. And yes, this includes recovery of deleted files.

It's a while ago I've used it last, so I'm not sure about how far its search facilities went. But it's one of the most widely used tools in this area.

TestDisk is available cross-platform – which includes (explicitly) Windows-7 64bit. A lot of documentation can be found on the linked official page, so you can head there for more details before installing it.

  • How to open a DD file on Windows? The instructions only work for Linux and MacOS. It seems I need 3rd party tools like OSFMount – Thomas Weller Jan 20 '16 at 21:43
  • As I wrote, quite some time ago I last used it. Can TestDisk not read the file itself? – Izzy Jan 20 '16 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.