FTK Imager is the free imaging tool from Exterro (formerly AccessData). It is the standard for forensic acquisition of disks, partitions, memory, and individual files in Windows environments.

What it does:

• Create bit-for-bit images in raw (dd), E01 (EnCase), AFF, or S01 formats.
• Compute MD5 + SHA-1 of the source and image for chain-of-custody.
• Capture live RAM to a .mem file.
• Mount images read-only and browse content.
• Export the protected $MFT, registry hives, and Volume Shadow Copies.

• First-responder acquisition before powering off a suspect host
• Capturing volatile RAM in a kidnap-and-go scenario
• Producing court-defensible E01 images