FTK Imager

Creating verified forensic images of disks and memory, previewing content and exporting files without altering the source. Interviewers ask because acquisition order and hash verification are what make evidence defensible — the imaging step is where cases are won or lost.