Warning
Sorry, this may sound a bit harsh, but the statements
I will use for LEGAL purposes
and
Being a beginner
are an extremely dangerous combination. If you really need it for legal purposes, call an expert.
The reasons are
- for legal purposes, you need to follow processes which you probably don't know
- if you haven't followed those processes, your evidence item will not be accepted
- you'll need much more then just a disk imaging software, e.g. an accepted hardware write protector
Suggestion: read a book like Computer Forensik (German, sorry), written by someone who actually performs the job and which also focuses on the legal aspects of acquiring disk images. Do not read a book like Computer Forensic Hacks (German, sorry), which is nice to read, but is just a collection of random computer tricks.
In a good book, you'll find
- that you should come with an attestor
- that you should document time, date and actions taken
- that you should give reasoning why you do something
- that you should take photographies of how you dismount the PC
- how to label the evidence items
- that you should take photographies of how you mount the hardware write protection
- that you take a copy of the evidence item first (read original data only once)
- that you then work on another copy in order to keep the first copy intact
Recommendations
With this in mind, there are lots of disk imaging tools available, but most of them will not qualify for legal purposes. Such tools are typically very expensive and you won't even find a price on their website, because it's "contact sales" price, which means horrible expensive.
I know the following tools which are accepted for forensic analysis in the US:
Access Data Forensic Toolkit or, if you just need imaging, Access Data FTK Imager. Access Data also provides a 5 year old Lite version for free. That one may not be able to read new file systems.
The other is Guidance Software EnCase. Also, the Forensic Imager can be obtained separately. There's a free trial available, but I think you have to register at least.
Those tools meet all your requirements:
- create disk images: yes, but perhaps in their own and not very common formats
- mount virtual drives: yes, usually read-only, because you shall not modify in legal cases
- an entirely cmd line based software is not an option: both are graphical tools
- I do not want ads popping up: certainly, a several thousands USD software will not show ads
- companies located in very weird countries: Access Data and Guidance Software are both located in the US. Some call that a weird country.
- install a bunch of questionable applications: certainly not
- serious and reliable software: you won't find a lot more reliable software than digital forensics used in court
- OS is Windows 7: supported
- I am well ready to pay: we'll see ;-)
As a beginner, you might want to become familiar with the topic first, before you buy one of the tools above. To do so, check the SIFT Workstation, which is a virtual appliance for free. It is provided by the SANS Institute (SysAdmin, Networking and Security), DFIR department (Digital Forensic & Incident Reponse). They also offer trainings and even certification.
