Evimetry Imager



Evimetry Imager is the fastest forensic imager. It provides a fast, simple and safe way to create physical disk images by booting from a USB flash drive or hard drive.



A USB forensic OS based forensic imager.

Evimetry Imager provides fast and simple forensic imaging of Intel Macs & PC's via a Linux-based Forensic Operating System (the Evimetry Deadboot).


Acquire as fast as your hardware is capable of. Using a single USB connected SSD storage drive, acquire at rates of around 20 GB/min. With Imager Multi, image to multiple evidence storage devices at the same time, to reach speeds in the 100's of GB/min.

Easy to provision.

Create Evimetry Imager USB boot devices with only a few mouse clicks. For large USB disks the remaining space is configured and "Blessed" for storing evidence. Great for low-port count modern laptops.

Foolproof write blocking.

Evimetry Imager automatically manages write blocking, and will only write to evidence storage devices that have been whitelisted or "Blessed" as good for writing to.

Simple, complete imaging.

Evimetry Imager is for simple and foolproof complete acquisitions of a single disk at a time. As such, it doesn't support Evimetry's more complex allocated-only and non-linear partial acquisition techniques.

Works with your current toolset.

Evimetry's AFF4 images are simply consumed using our freely available Filesystem Bridge, and a growing number of commercial and open source tools.

Deadboot acquisition

This tutorial steps you through using Evimetry Imager to acquire the disk of a computer booted from the Evimetry Deadboot.

Learn how to acquire with the Deadboot Imager UI

Streamlined single computer acquisition with Evimetry Imager

This screencast demonstrates the creation of a combined Evimetry Deadboot/Evidence Storage USB Device, followed by rapid acquisition using Evimetry Imager.

Buy Evimetry Imager.

Please contact us to purchase at the following pricing. Prices are in US Dollars.

Imager   Imager Multi   Advanced Imager   Responder
$150   $600   $1,200   $2,500
Fast bare metal acquisition   Fastest multi-destination bare metal acquisition   Live analysis & multi destination bare metal acquisition.   Local and remote accelerated acquisition & live analysis.
Dead boot single destination acquisitions      
Dead boot multi-destination striped acquisitions -      
Remote network control of acquisition operations -   -    
Collector based acquisitions -   -    
Concurrent dongle free acquisitions 1   1   2   2
Concurrent advanced acquisitions (using dongle) 1   1   2   2
Remote Live agent network based operations (Windows, Linux, OSX) -   -   -  
Remote in-cloud evidence storage agent -   -   -  
Remote Volatile Memory acquisition (Windows, MacOS, Linux) -   -   -  
Complete Physical Disk acquisition      
Partial Physical acquisition of allocated only -   -    
Partial Physical acquisition (profile based) -      
Convert AFF4 to EWF & RAW      
Mount local images as virtual file or disk      
Mount remote images as virtual file or disk -   -    
Node to node image transfer -      
Communications encrypted with strong TLS 1.2 crypto -   -