Sherlock Forensics Disk Imager Reviews & Product Details

Sherlock Forensics Disk Imager is a free forensic disk imaging tool for Windows 10 and 11 that writes raw (dd) and E01 images and, unlike FTK Imager and Guymager, resumes interrupted E01 acquisitions with digest continuity instead of forcing a start-over. A pipelined engine reads, hashes, compresses and writes in parallel for roughly 3x the throughput of serial imagers (231 to 751 MB/s measured on E01 with SHA-256, SHA-1 and MD5). Three-pass SHA-256 verification, optional SHA-1 and MD5, segmented dd output for FAT32 and exFAT destinations, and built-in chain of custody fields produce a manifest ready for court. Safety controls refuse to write an image to the drive being read, and a live mission control console shows an entropy-shaded drive map, streaming hash lanes and throughput in real time. Single executable, built by CISSP, ISSAP and ISSMP certified forensic examiners. Free.