disk imaging and acquisition tool execution detector — free browser tool | fatcousin

drop prefetch shimcache or 4688 evtx csv and mft csv · detect disk imaging tool execution · identify when disk images were created · surface forensic image files and acquisition method · runs locally

disk acquisition artifacts

drop prefetch / shimcache / 4688 evtx / mft csv (multi-file)

or click

Select file

FTK Imager · dc3dd · dcfldd · Arsenal Image Mounter · E01/AFF/raw · dd command lines · UNC remote imaging

drop prefetch · shimcache · 4688 evtx · mft csv

ready