Output Formats
Sherlock Forensics Disk Imager supports two acquisition formats used by every major forensic analysis platform. Raw .dd images can be written as a single monolithic file or segmented at 2 GB, 4 GB or 10 GB boundaries to accommodate FAT32 and exFAT destination volumes. EWF format produces .E01/.E02 segmented images compatible with EnCase, FTK, Autopsy and X-Ways. Both formats capture a bit-for-bit copy of the source drive including slack space, unallocated clusters and hidden host-protected areas where supported by the drive controller.
Three-Pass SHA-256 Verification
Verification is not optional and it is not a single pass. Sherlock Forensics Disk Imager reads the source drive and computes a SHA-256 hash. It then re-reads the source drive from the first sector to the last and computes a second SHA-256 hash. Finally it reads the completed image file and computes a third SHA-256 hash. All three hashes must match. If the source drive returns inconsistent data between the first and second reads, the imager flags the discrepancy. If the image hash diverges from the source hashes, the acquisition fails verification. This three-pass approach detects failing drives, intermittent read errors and write corruption on the destination media. Standards from NIST CFTT require demonstrable hash verification of forensic images.
Multi-Hash Computation
SHA-256 is the default hash algorithm. SHA-1 and MD5 are also available. All selected algorithms are computed simultaneously during a single read pass so enabling multiple hashes does not increase acquisition time. Many agencies and courts still require MD5 alongside SHA-256 for backward compatibility with older case management systems. Sherlock Forensics Disk Imager records all computed hashes in the text manifest and in the EWF header fields when using E01 format.
Resumable Imaging
FTK Imager does not resume. If your acquisition fails at 90% due to a power outage, a USB cable disconnect or a system crash, you start over. Sherlock Forensics Disk Imager resumes. When the imager launches, it checks for incomplete imaging sessions. It identifies the source drive by querying the drive serial number through Windows IOCTL calls. If a matching incomplete session exists, the imager picks up from the last verified sector boundary. No data is re-acquired unnecessarily. For large drives that take 8 to 12 hours to image, resumable acquisition is not a convenience feature. It is a necessity.
Chain of Custody Metadata
Every acquisition requires the examiner to enter case number, evidence number and examiner name before imaging begins. Agency and notes fields are optional but recommended. This metadata is written into both the plain-text manifest file and the EWF header fields when producing E01 images. The manifest includes drive serial number, drive model, drive capacity, sector size, acquisition start time, acquisition end time and all computed hash values. This provides a complete chain of custody record that accompanies the image file. Defense counsel and opposing experts can verify every detail without accessing the original evidence. Guidelines from SWGDE require documented chain of custody for all digital evidence acquisitions.
Safety Controls
Sherlock Forensics Disk Imager refuses to write an image to the same physical drive it is reading from. The imager queries the physical drive number through IOCTL_STORAGE_GET_DEVICE_NUMBER for both source and destination and blocks the operation if they match. This prevents the most catastrophic operator error in forensic imaging: overwriting evidence with its own image. The application runs elevated through an embedded manifest that requests administrator privileges at launch. No separate UAC prompt is required after initial consent.
Bad Sector Handling
Damaged media is common in forensic casework. When the imager encounters an unreadable sector, it retries the read on a per-sector basis. If the sector remains unreadable after retries, the imager fills the corresponding bytes in the image with 0xBA (a non-standard fill byte that is easily identifiable in hex analysis). The offset and length of every bad sector are logged to a CSV file alongside the image. Examiners can review the CSV to determine whether unreadable regions overlap with areas of evidentiary interest. Imaging continues to completion regardless of bad sector count.
USB Write Blocker Integration
Sherlock Forensics Disk Imager auto-detects whether Sherlock Forensics USB Write Blocker is active on the system. If write protection is not enabled, the imager displays a warning and offers one-click launch of the write blocker. This integration ensures examiners do not accidentally image a drive without write protection in place. The two tools are designed to work together as a forensic acquisition workflow.
Single Executable
Sherlock Forensics Disk Imager is a single 4.4 MB executable. No installer. No C++ redistributable. No .NET runtime. No Java. Copy it to a USB drive or network share and run it. This makes deployment trivial in enterprise environments and eliminates dependency conflicts on forensic workstations that may run multiple tool versions. The executable is digitally signed and the SHA-256 hash is published for download integrity verification.