Terminology¶
E01 / EWF file: the Expert Witness Format, an industry-standard forensic image container that stores the acquired disk data alongside metadata and cryptographic hash values. This is the primary image format produced by LLIMAGER-win and LLIMAGER Linux.
DD / Raw image: a bit-for-bit, uncompressed image format. LLIMAGER-win and LLIMAGER Linux can fall back to this format (via ddrescue) when a source disk is damaged or unstable and sector-level recovery is needed.
Device Identifier (ID): the identifier the operating system assigns to a physical disk. Under Windows, this appears in Disk Management as "Disk 0", "Disk 1", etc. Under the LLIMAGER Linux live environment, disks are identified using Linux device naming (e.g., /dev/sda, /dev/nvme0n1).
USB Label / Name: the name assigned to a mounted partition, as shown in File Explorer (Windows) or the file manager (Linux live environment). A single USB drive can contain more than one partition, each with its own label.
LLIMAGER-win USB Drive: a USB drive containing the LLIMAGER-win executable, this manual, and the required license file (llimager.lic). This same drive is typically prepared with Ventoy so it can also boot into the LLIMAGER Linux dead-box environment.
Ventoy: an open-source tool used to prepare a USB drive that can boot one or more ISO images directly, without needing to re-flash the drive for each one. LLIMAGER-win's dead-box USB uses Ventoy to boot the LLIMAGER Linux live environment while still allowing the same drive to be used as a normal USB disk under Windows.
Dead-Box Acquisition: the practice of imaging a target disk without booting or trusting its native operating system. In the LLIMAGER suite, this is achieved by booting the target machine into the LLIMAGER Linux live environment instead of Windows, ensuring the internal drive's OS is never mounted, modified, or executed.
LLIMAGER Linux: the companion acquisition application that runs inside the bootable Linux live environment. It provides the same evidence-capture workflow as LLIMAGER-win (Full File System and Targeted acquisitions, hashing, and signed PDF log generation) but operates entirely independently of the target's installed operating system — Windows or Linux.
ewfacquire: the primary imaging engine used by both LLIMAGER-win and LLIMAGER Linux to acquire disks directly to E01/EWF format.
ddrescue: the fallback imaging engine used when a source disk shows signs of physical damage or instability, prioritizing maximum data recovery over acquisition speed.
BitLocker Recovery Key: the key used to decrypt a BitLocker-protected Windows volume. Forensic best practice is to acquire the encrypted disk in its raw, still-locked state first, and apply the recovery key afterward during analysis — this avoids unlocking the drive on-site and preserves the original encrypted evidence.
LLIMAGER and LLSmartVerify are trademarks of e-Forensics Inc. Miami, Florida, USA. The integrated forensic integrity framework, comprising the LLIMAGER acquisition sequence and the LLSmartVerify blockchain-anchored verification ecosystem, is U.S. Patent Pending (App No. 63/908,380)