3

I am looking for a free computer forensics software like Guidance Encase.

The software must

  • collect data / capture disk images (> 2 TB)
  • open dd-style files
  • process the collected data
    • especially search for deleted and recycled files
    • find files by file name pattern / extension
    • optional: find files by date / size / attributes / ACLs
  • be gratis
  • run on Windows 7 (x64)
Improve this question

1 Answer 1

Reset to default
3

TestDisk should be your candidate:

  • collect data / capture disk images: Yes (I don't know of a size limit)
  • open dd-style files: Yes (that's what I used if for often; it analyzes the structure and, when in doubt, asks you for partition types etc.)
  • process the collected data: Sure (wouldn't make sense otherwise). You can even extract selected information, browse through directories, and more. And yes, this includes recovery of deleted files.

It's a while ago I've used it last, so I'm not sure about how far its search facilities went. But it's one of the most widely used tools in this area.

TestDisk is available cross-platform – which includes (explicitly) Windows-7 64bit. A lot of documentation can be found on the linked official page, so you can head there for more details before installing it.

Improve this answer
2
  • How to open a DD file on Windows? The instructions only work for Linux and MacOS. It seems I need 3rd party tools like OSFMount
    – Thomas Weller
    Jan 20, 2016 at 21:43
  • As I wrote, quite some time ago I last used it. Can TestDisk not read the file itself?
    – Izzy ♦
    Jan 20, 2016 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.