For registration questions, please visit the Registration FAQ page.

Q: What type of image files can be created within Forensics Replicator?
A: Types of Images:

• RAW: Format compatible with most forensic analysis programs.
• VHD (Virtual Hard Disk): Compatible with Microsoft VirtualPC.
• Split: Splits the image into smaller, user-desired chunks.
• Compress: Compresses the image while the copy is being done.
• Crypt: Encrypts the image with 128-bit encryption.

Q: I am attempting to restore an image to a hard drive. Why can I not see my hard drive on the Wizard screen ‘Select Physical hard drive destination’?
A. If you are using Window OS 7 please lower the UAC (User Account Control) on the PC. Click Start >> Control Panel >> User Account >> Change User Account Control Settings Q: Can I create a checksum of a physical disk or image file?
A: Forensics Replicator allows the user to calculate MD5 and SHA1 checksums after or during the image creation process.

To generate a checksum:

• Begin my selecting the File tab.
• Then select Calculate Checksum of Physical Drive or Calculate Checksum of Image of Physical Drive depending on whether the checksum originates from a physical drive or an image file.
• The prompt then asks the user to locate the image file location or to identify which physical drive you wish to include.
• Next the prompt window will ask you to set the amount of data you wish to process.
• Next the image file or physical drive will now begin to process. When complete the checksum results are shown and may also be found the case’s report document.

Q: How do I incorporate the batch assistant into the image creation process?
A: By using the batch assistant you can chain operations on several images. There are two different interfaces of the Batch Assistant:

• With File Batch Assistant you will have all the settings in one dialog box.
• With File Batch Assistant wizard you will have several dialogs boxes step by step.

When Forensic Replicator executes a batch command it repeats the sequence of creating an image in memory reading from a source location, and saves this image to a destination. When the source has no image the batch is complete.

The following sources can be selected:

• Set of floppies: Forensic Replicator will read floppies. You need to tell Forensic Replicator how many floppies you want to read. Set of images files: Forensic Replicator will load images. You can open a list file (.WIL), a set of compressed image (.WLZ, a ZIP file with a .WIL and several .IMA) or add images manually.
• Directory injecting: Will inject directories into an image. If the directory name contains a number it can increment the directory name and make an image for each directory. If a directory is bigger than an image Forensic Replicator will make several images.

The following destinations can be selected:

• Set of floppies: Forensic Replicator will write to floppies. You tell Forensic Replicator if you want it to format also.
• Set of image files: Forensic Replicator will write images. You specify the filename of the first, and Forensic Replicator increments the subsequent filenames and you can optionally make a list file (.WIL) with a comment. Or you can create a set of compressed images (.WLZ): one file will contain the list and all images.
• File extraction: Forensic Replicator will extract files from an image to directories that you specify. It can also increment the directory name. Before running the batch, you can save your configuration in a batch configuration file (.BWZ). This file can be opened later to run batch with same parameters. Like .WIL, BWZ files are text readable files.

Q: What does the “Drive-To-Drive” duplicate option perform?
A: This option is ideal for any additional copies of data that need to be made. It is also an excellent backup tool for your own forensic machine.

To access the duplicate physical drive option go to the File menu and select the Duplicate Physical Drive option. Once this option is selected you will be given guidance through a wizard for a source and destination for the imaging.

Note: You will need to make sure your drive sizes are the same or the destination is larger for this feature to work properly.

Q: How do I split an image file?
A: With Forensic Replicator's acquisition wizard you can break a single large image into smaller pieces.

Within the options of the acquisition wizard the a dialog box will appear with options for the image file output.

You can break the image into any sized segments. All segments will need to be in a single directory for Forensic Replicator to restore them.

If the destination drive is a FAT or FAT32 partition the image will have to be split into maximum of 2 or 4 gb size files.