In the last two steps (step 6 and 7), the step 6 allow us to compress the acquired image to reduce image size. In step 3 and step 4 and step 5, you can enter the “technician name”, “image number” and “description” to further describe the acquired project, all these steps are optional. In step two “destination”, we set the destination of the image file where we want to store it, in my case I used D: drive and named the image “ DarknessGate_USB”, the acquired image has the extension. In my case I select drive Q: which is my USB drive. In the step one we select the source drive that we want to capture, this could be a removable disk, USB drive or just one of the partition of the main disk of the computer. The steps in red are mandatory, while the green one is optional In main program window, click on “Capture & add image” Install the program using simple steps with the default settings.įirst star ProDiscover, a pop up window may appears, this windows allows you to enter project number, name and description as follow: If the link changed go to and search for it. Also avoid using backup software to have an image of the original drive as backup software cannot copy deleted files, emails and fragment files however in some cases it will be necessary to use backup software in order to recover data from damaged hard disk however the integrity of files is not guaranteed in the last case.ĭownload ProDiscover program from the following link Important note: a sector-by sector image (known also as bit-stream image) is different from performing a copy of the disk using standard windows copy/paste function, as this will not copy hidden data and slack spaces.

Let us first describe what we mean by a drive image copy, a disk image is a file that contains the exact same data and structure information as the original one, we can have this image through performing a sector-by sector image copy of the original disk, in this way we perform a replication of the same original disk. The first thing we need to do when conducting computer investigations is to have a copy of the suspect drive, in this tutorial Iam going to show you how to use ProDiscover basic software tool to acquire and analysis a suspect drive.

Windows XP, Vista, Win 7, server 2008 (all versions)Īll Windows based file systems including FAT 12/16/32/exFAT and NTFS Dynamic disks in addition to file systems such as SUN Solaris UFS and Linux Ext 2/3/4, and Mac OSX HFS+

Download prodiscover basic 64