Creating an Image (Exact Bit-by-Bit Copy) of Data from a Physical Medium

• aimage
  http://www.afflib.org/aimage.php
• CDRDAO – “Disk-At-Once Recording of Audio and Data CD-Rs/CD-RWs”
  http://cdrdao.sourceforge.net/
• CloneCD and CloneDVD (Slysoft)
  http://www.slysoft.com/
• dd (Unix Command) - used for low-level copying and conversion of data (can create disk images by operating below the filesystem level)
  http://www.gnu.org/software/coreutils/manual/html_node/dd-invocation.html
• dd_rescue - version of dd, designed specifically for recovering data from a medium that has errors (e.g. after hard drive crashes)
  http://www.garloff.de/kurt/linux/ddrescue/
• dcfldd - includes several enhancements to dd, including ability to create MD5 hashes on-the-fly
  http://dcfldd.sourceforge.net/
• DriveImage XML (Runtime Software) - creates a raw or compressed image file and associated XML file, which serves as a manifest of all the files in the image
  http://www.runtime.org/driveimage-xml.htm
• Forensics Wiki – Disk Imaging
  http://www.forensicswiki.org/wiki/Category:Disk_Imaging
• IMAGE (Digital Intelligence) – for creating images of floppy disks
  http://www.digitalintelligence.com/software/disoftware/image/
• libewf – open source tool for creating images as part of evidence files in the format recognized by EnCase, validating the evidence files and converting to/from raw format
  http://sourceforge.net/projects/libewf/
• LinEn (Guidance Software) – Linux-based tool for creating images as part of evidence files in the format recognized by EnCase
  http://www.guidancesoftware.com/support/LinEn_LicenseAgreement.aspx
• Media Exploitation Kit (Basis Technology)
  http://www.basistech.com/digital-forensics/mek.html
• Power ISO - "open, extract, create, edit, burn, compress, encrypt, split and convert ISO files, and mount these files with internal virtual drive"
  http://www.poweriso.com/
• SafeBack (Forensics Source) - "used to create mirror-image (bit-stream) backup files of hard disks or to make a mirror-image copy of an entire hard disk drive or partition"
  http://www.forensics-intl.com/safeback.html
• Zlon (ZAR Data Recovery)
  http://www.z-a-recovery.com/zlon-disk-cloning.htm