When an investigator or the police have to check the use of a computer it is not that he starts hacking around Windows looking for files, sorting them by date and so on. I am not an expert in the field but I know that an internal check is made on the use of the hard disk using special digital investigation programs. A program of this type makes the copy of the hard disk, allows the analysis of the files to verify, for example, any illegal use, causes of virus infections or evidence of some crime. The well-known software development company Passmark, already met in this blog for its benchmark tools, has released a free program called OSForensics that allows you to control in depth every detail of use of the computer.
It also provides some really simple to use tools that can be used to make an exact copy of a computer hard drive .
However, this cloning does not have backup or repair purposes but only analysis and, if anything, recovery of files that have been mistakenly deleted.
The forensic copy of the computer disk serves several purposes, some limpid, others much less. Since this tool is free and very easy to use, I don't hide that it can be used, for example, to make a copy of a colleague's or friend's computer in secret.
Among the best forensic computer programs to find all the data of a computer there is OSForensics, a real free suite for computer investigators let's see the related tools that can have a more immediate utility.
OSFClone is currently offered as a free tool (it may not be anymore when exiting beta) and works on any computer (Windows, Mac Linux).
OSFClone is an ISO image to burn to a CD, DVD or USB stick.
Installation on a USB stick requires the execution of the ImageUSB.exe file and some additional steps described in the instruction page.
By restarting the computer with boot from CD / DVD player or USB stick, OSFClone starts immediately and automatically, regardless of the operating system installed on the computer. An auto-boot program starts in place of the operating system, requires no authentication or password of the PC owner and works even if Windows no longer works.
There is no graphical interface but, even if only at the command line, it is really simple to use. At the beginning you must press Enter then the program immediately displays the options available in a text menu. Use the keyboard to choose one of the options by writing the number and press enter to begin the operation.
OFSClone is able to create copy images of the disk or of a partition, in raw format (IMG, ISO or BIN) or in Forensics Advance (AFF) format.
Another interesting option is the possibility to verify that the cloned drive is identical to the copied hard disk, comparing the hashes between the clone and the source drive.
Once the copy of a hard disk has been obtained, to open it on another computer as well, you can use the OSFMount software which allows you to mount the image and analyze it.
Another free program capable of making an exact copy of a hard disk, sector by sector, is HDD Raw Copy Tool .
HDD Raw Copy Tool supports S-ATA (SATA), IDE (E-IDE), SCSI, SAS hard drives and also works with any USB or FireWire port, therefore for copying USB sticks, SD cards, MMC cards and Memory Sticks. The tool creates a sector-by-sector copy of all areas of the hard disk (including the MBR, the boot record).
I want to clarify that these are not backup tools and, although they can be used to recover files from your computer, it is more an analysis and verification program suitable only for very specific needs.
Another article describes the best programs to clone a disk and backup and restore your computer .
