Skip to content

Before You Start

LLIMAGER-win performs live, native acquisitions directly from a running Windows session, using industry-standard imaging engines (ewfacquire for E01, ddrescue as a fallback) rather than relying on OS-specific restore utilities. This means virtually any supported Windows machine can be imaged from an authenticated admin session, subject to the constraints below.

The imaging process acquires the source disk directly to the E01 (EWF) format, which is natively compatible with most forensic and e-discovery applications (FTK Imager, EnCase, Arsenal Image Mounter, etc.) without requiring a separate conversion step.

Full-Disk Encryption (BitLocker)

If the source disk is protected with BitLocker, the user can either capture the image in its raw, encrypted state—deferring decryption until analysis—or unlock the drive immediately to produce a decrypted image. To assist with this, the system provides the Recovery Key ID, making it easier for the user to locate the corresponding recovery key and enter it to unlock the drive.

When the Host OS Must Not Be Touched

For situations where the target machine's Windows installation should never be booted, mounted, or modified — active malware investigations, systems with anti-forensic tripwires, or any case where the evidentiary integrity of the host OS itself matters — use the dead-box acquisition path instead of the native LLIMAGER-win workflow. See Dead-Box Imaging (Linux Boot) for details.

Image Encryption

The application does not currently provide an option to encrypt the E01/DD image directly, as encrypted forensic images are not universally supported by downstream forensic applications.

If a resulting image must be securely encrypted, the following options are recommended:

  • Use a hardware-encrypted external USB disk as the destination for the image.
  • Encrypt the image file after acquisition and store it on a standard, unencrypted disk.
  • Copy the unencrypted image into a compatible encrypted container on a standard USB disk (BitLocker and Veracrypt are good examples).

Forensic applications change over time, and support for image types may vary. Test the image produced by LLIMAGER-win during your evaluation period to confirm compatibility with your downstream application(s).