Average Ratings 0 Ratings

Total
ease
features
design
support

No User Reviews. Be the first to provide a review:

Write a Review

Average Ratings 0 Ratings

Total
ease
features
design
support

No User Reviews. Be the first to provide a review:

Write a Review

Description

Sherlock Forensics Disk Imager is a specialized Windows application designed for the creation of forensic images from physical drives to assist in the acquisition of digital evidence. It generates raw DD images along with segmented files and EWF E01 formats, which are compatible with various forensic analysis applications. The tool meticulously documents case information, evidence details, and examiner data within a manifest and E01 metadata, while also calculating SHA-256 hashes and providing support for SHA-1 and MD5. Its verification process involves reading both the source drive and the completed image to ensure data integrity; other features include logging bad sectors, a console for live acquisitions, and a protective measure to prevent images from being saved back to the original drive. Aimed at professionals such as digital forensic examiners, law enforcement officials, incident response teams, and corporate investigators, it accommodates both dead-disk and live-acquisition processes on 64-bit versions of Windows 10 and 11. The application operates as a standalone executable, allowing it to function without the need for an installation or additional runtime dependencies, ensuring ease of use for its users. With its robust set of features, it stands out as a vital tool for those involved in the field of digital forensics.

Description

Sherlock Forensics Recover is a powerful Windows desktop application that allows users to explore drives and disk images, generate forensic images, and restore deleted files. Compatible with Windows 10 and 11, it supports a variety of file systems including FAT32, NTFS, exFAT, APFS, HFS+, ext, XFS, Btrfs, and ZFS. Users can conduct both quick and comprehensive scans, featuring signature-based carving, lost-partition recovery, and RAID reconstruction capabilities. The software identifies results using file metadata, signature location, or assumptions, and it flags files that are likely to have been overwritten. Additionally, it generates self-contained offline HTML reports, records SHA-256 hashes, and ensures that the source drive remains unaltered during operations. A free version is offered, while the Pro version, available for a one-time fee of $295, includes enhanced recovery features and the ability to analyze pagefiles for URLs, paths, IP addresses, and credentials. This tool is specifically designed for use by forensic examiners, IT professionals, and specialists in data recovery. Furthermore, the installation package is EV-signed and verified with SHA-256, ensuring a secure setup process. Its robust capabilities make it a reliable choice for anyone needing in-depth forensic analysis.

API Access

Has API No 

API Access

Has API No 

Screenshots View All

No images available

Screenshots View All

No images available

Integrations

No details available.

Integrations

No details available.

Pricing Details

$0
Free to download and use, with no trial period, feature restrictions or license fee.
Free Trial No 
Free Version Yes 

Pricing Details

$0
Free edition: browse, preview, export files, and create raw or E01 disk images. Pro is a $295 one-time purchase with no subscription; it adds deleted-file recovery, unallocated-space carving, RAID reconstruction, lost-partition search, and recovery of previous Windows versions.
Free Trial No 
Free Version Yes 

Deployment

Web-Based No 
On-Premises No 
iPhone App No 
iPad App No 
Android App No 
Windows Yes 
Mac No 
Linux No 
Chromebook No 

Deployment

Web-Based No 
On-Premises No 
iPhone App No 
iPad App No 
Android App No 
Windows Yes 
Mac No 
Linux No 
Chromebook No 

Customer Support

Business Hours Yes 
Live Rep (24/7) No 
Online Support Yes 

Customer Support

Business Hours Yes 
Live Rep (24/7) No 
Online Support Yes 

Types of Training

Training Docs Yes 
Webinars No 
Live Training (Online) No 
In Person No 

Types of Training

Training Docs Yes 
Webinars No 
Live Training (Online) No 
In Person No 

Vendor Details

Company Name

Sherlock Forensics

Founded

2006

Country

Canada

Website

www.sherlockforensics.com/pages/sherlock-disk-imager.html

Vendor Details

Company Name

Sherlock Forensics

Founded

2006

Country

Canada

Website

www.sherlockforensics.com/data-recovery-software

Product Features

Disk Imaging

Backup Scheduling No 
Bare-Metal Restore No 
Compression No 
Differential Backup No 
Disk Cloning No 
Encryption No 
Image Deployment No 
Incremental Backup No 
Web Access / Restoration No 

Product Features

Data Recovery

Web Access / Restoration No 
Backup Log No 
Backup Scheduling No 
Compression No 
Continuous Backup No 
Encryption No 
Incremental Backup No 
Local Server Options No 
Multiple System Support No 
Remote Server Options No 
Secure Data Storage No 

Alternatives

Sherlock Forensics Recover Reviews

Sherlock Forensics Recover

Sherlock Forensics

Alternatives

RS Partition Recovery Reviews

RS Partition Recovery

RecoverySoftware
Android Acquirer Reviews

Android Acquirer

Sherlock Forensics
Disk Drill Reviews

Disk Drill

508 Software