OSFClone is a free, self-booting software utility designed to create or clone exact forensic disk images, independent of the installed operating system. It supports multiple disk image formats, including raw, Advanced Forensics Format (AFF), and Expert Witness Compression Format (EWF). OSFClone preserves all disk data, including unused sectors, slack space, file fragmentation, and undeleted file records, making it suitable for forensic investigations. The tool can be booted from CD/DVD or USB flash drives and is compatible with FAT, NTFS, and USB-connected drives. It also provides options for hash verification, compression, and saving forensic metadata, ensuring the integrity and portability of disk images. OSFClone is distributed under the GPL v3.0 license and is intended for forensic professionals who require reliable disk imaging without altering the source drive.

Key Features

Forensic Disk Imaging Creates exact copies of disks for forensic purposes.

• Preserves unused sectors, slack space, file fragmentation, and undeleted file records.
• Supports imaging of FAT, NTFS, and USB-connected drives.

Multiple Image Formats Provides flexibility for forensic analysis.

• Supports raw, AFF (Advanced Forensics Format), and EWF (Expert Witness Compression Format).
• Can create images in dc3dd format for enhanced forensic reporting and on-the-fly hashing.

Bootable and OS-Independent Runs independently of the installed operating system.

• Bootable from CD/DVD or USB flash drives.
• Suitable for use on systems regardless of their OS state.

Hash Verification Ensures integrity of cloned images.

• Compares MD5 or SHA1 hashes between source and clone.
• Verifies that the disk clone is identical to the source drive.

Compression and Portability Helps manage storage and transport.

• Offers compression options to reduce image size.
• Increases portability and saves disk space.

Forensic Metadata Preservation Captures essential case information.

• Stores metadata such as case number, evidence number, examiner name, description, and checksum.

Benefits

Reliable Forensic Imaging Ensures evidence integrity for legal and investigative purposes.

• Minimizes risk of altering source evidence during imaging.
• Preserves all relevant disk data for thorough analysis.

Flexible and Efficient Workflow Supports a wide range of forensic scenarios.

• Multiple format support allows use with various forensic tools.
• Bootable design enables imaging on systems regardless of OS status.

Data Integrity and Verification Provides confidence in the imaging process.

• Built-in hash verification confirms image authenticity.
• Compression and metadata features streamline evidence management.