Back to Downloads

AtlantImage

v1.0.0WindowsFree
5Tools in One
3Hash Algorithms
2Image Formats
11Features
1Portable EXE
100%Free

Most forensic acquisition still means juggling five separate tools, each with its own license, install, and quirks. AtlantImage replaces them with a single portable executable that images drives, verifies evidence, triages live systems, recovers deleted files, and decrypts BitLocker offline.

Download Free (2.8 MB)Windows - 64-bit architecture - No account needed
AtlantImage screenshot 1
AtlantImage screenshot 2
AtlantImage screenshot 3

Overview

Every acquisition is hashed with MD5, SHA-1, and SHA-256, written with a manifest and audit log, and can be re-verified byte for byte. Written in Rust, built from published specifications, and cross-validated against the reference tools.

Features

Forensic imaging to raw (dd) and EnCase E01 (EWF) with segment splitting and DEFLATE compression
On-the-fly MD5 / SHA-1 / SHA-256 hashing during acquisition, no second pass
Read-back verification re-hashes the written image to prove it matches the source
Bad-sector recovery retries, zero-fills, and logs unreadable sectors (ddrescue/dc3dd behavior)
Volume Shadow Copy (VSS) capture for a consistent image of a live system
Verify and convert E01 images back to raw dd
Live NTFS triage extracts $MFT, $LogFile, and $UsnJrnl:$J straight off the raw volume
NTFS undelete recovers intact and partially-overwritten files, flagging SSD TRIM-discarded content
BitLocker offline decryption from the recovery password (AES-XTS)
Desktop app and scriptable command line from the same engine
Single statically-linked executable, auto-elevates when a task needs Administrator

Download AtlantImage

2.8 MB - Windows - Free - No account required

Download Now

System Requirements

  • Windows 10 or Windows 11
  • 64-bit architecture
  • Administrator privileges for device, volume, triage, undelete, and BitLocker operations (auto-elevates)
  • No install and no runtime required (self-contained)

Release Notes

v1.0.02026-06-25
  • Forensic disk imaging to raw (dd) and EnCase E01 with on-the-fly hashing and read-back verification
  • Bad-sector recovery and Volume Shadow Copy acquisition
  • Live NTFS triage of $MFT, $LogFile, and $UsnJrnl:$J
  • NTFS file undelete with TRIM-aware integrity labeling
  • BitLocker offline decryption from recovery password
  • Desktop app plus scriptable command line