OSFClone is a free bootable tool that allows you to create an image of a hard drive.
The program doesn't take any shortcuts, by for example only copying used sectors, so you can be sure that the final image will be an exact copy of your drive. Whatever unused sectors, slack space, file fragmentation or undeleted file records are on the original disk, will be faithfully reproduced on the image.
As well as creating raw images, OSFClone is also able to save drive images in other common formats, including dc3dd and AFF. This may allow you to analyse the image with other computer forensic tools.
And if you have no other tools, then you can use PassMark's OSFMount to mount the image on another PC. If, say, the hard drive you've imaged contains some really important files that you've accidentally deleted, then this would mean that you could work at recovering them on a second system. And if they're overwritten by some destructive part of the recovery process, it doesn't matter - you can return to the original image and start again.
What's new in 1.3.1000?
- Changed Linux OS to Porteus V4.0 RC4
- Fixed bug with Compute Checksum calculation when choosing SHA256 and SHA512 would actually be computing SHA1.
- Updated dc3dd to 7.2.646
- Updated libewf to 20171104 (included libsmdev-20171112)
- Updated afflib to 3.7.16
- Updated aimage to 3.2.5
- Updated ddrescue to 1.23
- HFS+ filesystem supported for read/write.
A straightforward disk imaging tool that has many computer forensics applications