AtlantSECURITY Let’s talk
Menu
Back to Downloads

FREE SECURITY SOFTWARE

AtlantImage

v1.0.0WindowsFree

Acquire evidence. Verify integrity.

Image drives, verify hashes and recover evidence with one portable Windows toolkit.

Download Free (2.8 MB)Windows - 64-bit architecture - No account needed
AtlantImagePRODUCT PREVIEW
5Tools in One
3Hash Algorithms
2Image Formats
11Features
1Portable EXE
100%Free

01 / TOOL DETAILS

Overview

Every acquisition is hashed with MD5, SHA-1, and SHA-256, written with a manifest and audit log, and can be re-verified byte for byte. Written in Rust, built from published specifications, and cross-validated against the reference tools.

Most forensic acquisition still means juggling five separate tools, each with its own license, install, and quirks. AtlantImage replaces them with a single portable executable that images drives, verifies evidence, triages live systems, recovers deleted files, and decrypts BitLocker offline.

03 / TOOL DETAILS

Features

Forensic imaging to raw (dd) and EnCase E01 (EWF) with segment splitting and DEFLATE compression
On-the-fly MD5 / SHA-1 / SHA-256 hashing during acquisition, no second pass
Read-back verification re-hashes the written image to prove it matches the source
Bad-sector recovery retries, zero-fills, and logs unreadable sectors (ddrescue/dc3dd behavior)
Volume Shadow Copy (VSS) capture for a consistent image of a live system
Verify and convert E01 images back to raw dd
Live NTFS triage extracts $MFT, $LogFile, and $UsnJrnl:$J straight off the raw volume
NTFS undelete recovers intact and partially-overwritten files, flagging SSD TRIM-discarded content
BitLocker offline decryption from the recovery password (AES-XTS)
Desktop app and scriptable command line from the same engine
Single statically-linked executable, auto-elevates when a task needs Administrator

Download AtlantImage

2.8 MB - Windows - Free - No account required

Download Now

System Requirements

  • Windows 10 or Windows 11
  • 64-bit architecture
  • Administrator privileges for device, volume, triage, undelete, and BitLocker operations (auto-elevates)
  • No install and no runtime required (self-contained)

Release Notes

v1.0.02026-06-25
  • Forensic disk imaging to raw (dd) and EnCase E01 with on-the-fly hashing and read-back verification
  • Bad-sector recovery and Volume Shadow Copy acquisition
  • Live NTFS triage of $MFT, $LogFile, and $UsnJrnl:$J
  • NTFS file undelete with TRIM-aware integrity labeling
  • BitLocker offline decryption from recovery password
  • Desktop app plus scriptable command line