Recovering Disk Images by Forensic Solutions

DiskInternals offers criminal investigators an easy way to access and recover data and fix file system errors occurring in disk images created by popular forensic suites such as EnCase and ProDiscover. Notably, neither EnCase nor ProDiscover have to be installed in order to read information from their disk images. What does that mean for you? By using one of DiskInternals tools (*), you’ll be able to copy files and folders from a disk image created by either forensic suite without having that suite installed. As a bonus, DiskInternals will allow performing comprehensive analysis of the disk images in order to discover and extract files that have been erased or wiped by performing a disk format operation.

(*) The following DiskInternals products can mount forensic disk images: RAID Recovery, Partition Recovery, EFS Recovery, and Diskinternals Uneraser. By the way, iin case of necessity of getting data from healthy or damaged VMware® VMFS disk, use DiskInternals VMFS Recovery™.

Background: Forensic Solutions and Disk Images

Data investigation and criminal analysis tools such as EnCase and ProDiscover capture entire disk images, saving contents of entire physical disks into individual files while guaranteeing authenticity of all data being captured. Later on, investigators can work with virtual disk images without requiring access to suspects’ original hardware.

What’s so important about having a data recovery application support forensic disk images? It’s all about speed, convenience, and savings, as well as the ability to access information that was deleted from suspects’ disks or erased after performing a disk format operation.

Mounting Forensic Disk Images

Once mounted, DiskInternals’ tools can do their recovery job
as well or better than it does with ‘real’ disks

DiskInternals data recovery tools such as Partition Recovery, RAID Recovery, EFS Recovery, and Diskinternals Uneraser can be used to replace popular data discovery suites such as EnCase and ProDiscover when mounting their disk images and accessing actual and deleted information stored on those disks. Notably, DiskInternals’ tools can perform as good as the original forensic investigation tools when reading and copying files and accessing deleted information located on those disk images.

The Easy Part

Extracting actual and deleted information from disk images created with EnCase or ProDiscover cyber security tools is easy. Launch the supported DiskInternals product of your choice and mount the corresponding disk image. The product will automatically scan the new volume to locate any available files and folders whether actual or deleted/erased. Everything happens completely automatically; all you need to do is selecting which files to copy.

All versions of Windows are supported, including Windows 2000, XP, 2003 Server, Vista, Windows 7 or 2008 Server. DiskInternals data recovery tools work without having EnCase or ProDiscover installed.