Skip to content

Preface

LLIMAGER-win is a cutting-edge solution for Windows forensic imaging. It has been meticulously crafted to meet the demanding needs of digital investigators, e-discovery services providers, law enforcement professionals, and cybersecurity experts. Built on a lightweight, portable Rust core with a modern web-based interface, LLIMAGER-win combines robust functionality with an intuitive user experience, making it the go-to tool for acquiring and preserving digital evidence from Windows systems.

LLIMAGER-win runs entirely from a USB drive, requiring no installation on the target machine. Whether you're conducting criminal investigations, e-discovery, or incident response, LLIMAGER-win empowers you to extract critical data from Windows computers with precision and efficiency.

Two Acquisition Paths, One USB

LLIMAGER-win was designed around a simple principle: the right acquisition method depends on the state of the machine in front of you.

  • Native (Live) Acquisition — When the target machine is already powered on and running a trusted copy of Windows, LLIMAGER-win runs directly from the USB drive under the live operating system, similar in spirit to how LLIMAGER operates on a Mac. This is the fastest path to a Full File System or Targeted acquisition.

  • Dead-Box Acquisition (Linux Boot) — When the host Windows OS must not be booted, touched, or trusted — for example, to avoid modifying system logs, triggering scheduled tasks, or dealing with full-disk encryption prompts — the same USB drive can instead boot the machine into an independent, forensically sound Debian-based Linux live environment via Ventoy. This companion environment runs LLIMAGER Linux, a purpose-built acquisition application that never mounts or writes to the internal drive's operating system. Because this method operates entirely outside of Windows, it can also be used to image Linux target machines using the same bootable USB, making it a versatile dead-box solution regardless of the host operating system.

Together, these two workflows give examiners a single, field-ready USB drive capable of handling both live and dead-box scenarios without swapping tools.

Designed for the Field

LLIMAGER-win is user-friendly and approachable for entry-level digital forensics examiners, while remaining powerful enough for advanced field work. It leverages forensically sound, industry-standard acquisition engines to ensure evidentiary integrity from the first byte copied.

Every acquisition — whether native or dead-box — produces a signed, tamper-evident PDF acquisition log with an embedded QR code, enabling instant chain-of-custody verification through the LLIMAGER Companion mobile app or the LLSmartVerify portal.