Whether you are creating forensic disk images, mounting physical media to inspect and analyze digital materials, or transferring files, BitCurator supports multiple acquisition scenarios.
Provides write-blocked access to removable media (e.g. USB drives, CD-ROMs, floppies)
BitCurator uses open source disk imaging tools, including Guymager and dcfldd, to capture bit-identical images from magnetic, optical, solid-state, and hybrid media. Disk images can be captured in various formats, including raw (just the bitstream), E01 (Expert Witness Format, supported using the open source libewf library), and AFF (Advanced Forensic Format).
Capturing disk images in forensic formats such as E01 and AFF provides many advantages. The images can be stored compressed or uncompressed, can be split into multiple storage containers, can be parsed at the filesystem level without explicitly extracting the raw image, and embed provenance and capture metadata along with the bitstream. Forensic images ensure that no inadvertent changes are made during pre-ingest chain-of-custody, and provide a consistent baseline for generating different types of access materials.