**Forensic imaging and evidence workflow for Windows — open, focused, and field-ready.**
DigitalImager is a desktop application for digital investigators, incident responders, and examiners who need a practical **FTK Imager–style workflow** without vendor lock-in. Capture disk and memory evidence, prove integrity with hashes, browse NTFS and FAT32 — including **E01 and raw images read directly in the app** — and produce case reports from a single, coherent workspace.
Built with **Qt 6** and **C++** for native Windows performance. Licensed under **AGPL-3.0**.
---
## Why DigitalImager
| Challenge | How DigitalImager helps | |-----------|-------------------------| | Scattered tools for imaging vs. file review | One case-centric UI: acquire, verify, browse, export, report | | Trust in evidence | MD5 / SHA1 / SHA256, post-imaging verification, source-vs-image comparison | | E01 everywhere in the field | Create and read E01 via **libewf**; browse partitions **without** mounting a virtual disk | | Repeatable case work | Structured case folders (`images`, `exports`, `logs`), manifests, and HTML reports | | Global teams | **English** and **简体中文** UI (system locale or explicit choice in Settings) |
---
## Core capabilities
### Case management
- Create and open investigation cases with examiner metadata - Import evidence files into the case `images` area - Evidence inventory, acquisition logs, and export paths tied to the active case - Recent cases and hash manifests (including sidecar / CSV where configured)
### Acquisition
- **Sources:** physical drives (`\\.\PhysicalDriveN`), logical volumes, existing E01 segments, DD / RAW / IMG - **Outputs:** EnCase-compatible **E01** (segmented, compressed) and **DD** raw images - Optional **source hashing before imaging** and **verification after imaging** - **Memory capture** through external **WinPMEM** (administrator privileges; configurable path)
### Integrity & hashing
- Compute hashes on files and devices - Verify image integrity (including E01-aware checks) - Hash source drives and compare source against acquired image - Export hash reports for documentation and disclosure
### Browse & analyze (no mount required)
- **Open image** — parse MBR/GPT, pick a partition, or read a volume-style image at offset zero - **NTFS:** MFT-backed directory tree, deleted entries, keyword search, file export - **FAT32:** Directory browse, long file names, single-file export - **Local volumes:** Same browse and MFT scan workflow on attached drives (admin where required) - Sector **hex view**, file properties, bookmarks, and directory / full-volume listing exports
### Reporting
- Case summary reports (HTML) - File bookmark export (HTML / JSON) - Directory listings and full-volume MFT exports
---
## Typical workflow
1. **New case** — name, examiner, evidence numbering 2. **Acquire** — image a drive or import an existing E01/DD into the case 3. **Verify** — confirm hashes and embedded E01 metadata align with your policy 4. **Review** — open the image in-app, navigate NTFS/FAT32, flag items, export artifacts 5. **Report** — generate case and hash documentation for the file
---
## Technical snapshot
| Item | Detail | |------|--------| | **Platform** | Windows 10/11, **x64** | | **Stack** | Qt 6, C++17, libewf, Windows device APIs | | **Evidence formats (native)** | E01 (libewf), DD/RAW/IMG; read/write imaging as supported above | | **File systems (browse)** | NTFS, FAT32 on live volumes and inside disk images | | **Languages** | 简体中文 (default), English | | **License** | [AGPL-3.0](../LICENSE) — source-available; comply with AGPL when you distribute or offer as a service |
Third-party components (Qt, libewf, WinPMEM, etc.) carry their own licenses — see [THIRD_PARTY.md](../THIRD_PARTY.md).
---
## Designed for transparency
DigitalImager is intentionally **not** a full forensic suite. It does **not** replace dedicated mount tools, mobile forensics platforms, or deep memory malware analysis. Formats such as AFF/AFF4, AD1, native VMDK/VHDX, exFAT/ext4 browse, and carved-media analysis are **out of scope today** or require conversion via external tools — see **Acquire → Supported evidence formats** in the app for the live list.
What you *do* get is a **clear, auditable path** from acquisition to file-level review on the formats investigators use every day.
---
## Who should use it
- **Law enforcement & government labs** exploring AGPL-friendly imaging tooling - **Corporate IR teams** standardizing disk capture and quick file triage - **Training & academia** teaching imaging, hashing, and NTFS/MFT concepts on real images - **Developers & integrators** extending an open Qt/C++ codebase for custom workflows
---
## Get started
1. Build with **Visual Studio 2022**, **Qt 6.x**, and **libewf** (see [README](../README.md)). 2. Run **DigitalImager**, create a case, and use **Acquire → Disk imaging** or **Open image**. 3. Set **Case → Settings → UI language** if you prefer English; restart once after changing language.
---
## Summary
**DigitalImager** brings case-based **imaging**, **verification**, and **filesystem-level review** together on Windows — with **direct E01/DD access**, strong **hashing**, and a **bilingual** interface — so teams can move from seizure to exportable findings with fewer tool switches and a license model that keeps the source in the open.
*Questions, contributions, and commercial licensing discussions should align with AGPL-3.0 and your organization’s compliance requirements.*
