OSFClone is a free, self-booting solution that enables you to create or clone exact raw disk images quickly and independently of the installed operating system.

OSFClone is a free, self-booting solution that enables you to create or clone exact raw disk images quickly and independently of the installed operating system.

In addition to raw disk images, OSFClone also supports imaging drives to the open Advanced Forensics Format (AFF). AFF is an open and extensible format to store disk images and associated metadata. An open standard enables investigators to quickly and efficiently use their preferred tools for drive analysis. After creating or cloning a disk image, you can mount it with PassMark OSFMount before analyzing it with PassMark OSForensics™.

OSFClone creates a forensic image of a disk, preserving unused sectors, slack space, file fragmentation, and undeleted file records from the original hard drive. Boot into OSFClone and create disk clones of FAT, NTFS, and USB-connected drives! OSFClone can be booted from CD/DVD drives or USB flash drives.

OSFClone can create disk images in the dc3dd format. The dc3dd format is ideal for computer forensics due to its increased reporting for progress and errors and ability to hash files on-the-fly.

Verify that a disk clone is identical to the source drive by using OSFClone to compare the MD5 or SHA1 hash between the clone and the origin drive. After image creation, you can choose from a range of compression options to reduce the size of the newly created image, increasing portability and saving disk space.

Use OSFClone to save forensic meta-data (case number, evidence number, examiner name, description, and checksum) for cloned or created images.

  Download