Overview

X‑Ways Imager is a specialized forensic disk‑imaging software developed by X‑Ways Software Technology AG. It is designed to create highly accurate, sector‑level images of physical media, making it ideal for digital forensics, incident response, and secure data capture. The software provides high‑speed imaging and cloning with advanced compression and the ability to optionally exclude free disk space to save storage and speed up the process. As a streamlined version of the full X‑Ways Forensics suite, Imager focuses on precise bit‑level disk imaging while supporting features such as RAID reconstruction, hashing, and portable execution from USB devices. It handles raw and compressed image formats and offers robust tools for damaged or partially unreadable media, including backward filling and the detection of special protected zones on drives. X‑Ways Imager also enables efficient handling of multiple disk types, including hard drives, SSDs, and external storage, with automated reporting for forensic documentation.

Features and Capabilities

• Core Imaging Functions:
  • High‑speed, sector‑level disk imaging optimized for forensic accuracy.
  • Ability to create raw images or compressed evidence images in various formats (.e01).
  • Optionally exclude free space to reduce image size and save processing time.
  • Backfill damaged sectors to maximize data recovery from problematic media.
  • Supports imaging of entire disks or selected partitions.
• Advanced Forensic Options:
  • Intelligent compression that balances speed with storage efficiency.
  • Computes cryptographic hashes (e.g., MD5, SHA‑1, SHA‑256) during imaging for verification.
  • Detection and capture of hidden or protected areas, including HPA/DCO zones.
  • Portable operation from USB devices without installation, supporting field forensics.
  • Supports read‑only imaging to prevent modification of evidence during capture.
• RAID and Disk Management:
  • Virtual reconstruction and imaging/cloning of disk-based RAID arrays (JBOD, RAID0, RAID5/6, etc.).
  • Clone entire disks or individual partitions efficiently.
  • Convert images between supported formats while maintaining forensic integrity.
  • Handles both standard and non-standard sector sizes for compatibility across storage types.
• User Interaction & Tools:
  • Hex and text sector display for detailed manual review of disk content.
  • Menu-driven workflow for opening disks, creating/restoring images, and cloning drives.
  • Automatic generation of technical detail reports for auditing and forensic documentation.
  • Supports batch processing of multiple disks for streamlined operations.
  • Flexible configuration options for imaging speed, compression, and verification methods.