Imager / Viewer
Free
Any use, no time limit, no account.
Image disks, USB media and optical discs, and open existing cases.
Download freeEditions and pricing
Paid editions are perpetual licences. Each edition includes everything in the one to its left.
Recovery
$995 perpetual
Maintenance renewal $269/year.
1-year term licence $398.
Every filesystem, deleted files, partition recovery, carving and damaged volumes.
Request a quoteForensic
$1,995 perpetual
Maintenance renewal $539/year.
1-year term licence $798.
Recovery, plus hashing, search, YARA and Sigma, artifacts, timeline and reports.
Request a quoteComplete
$2,995 perpetual
Maintenance renewal $809/year.
1-year term licence $1,198.
Forensic, plus volume decryption, Hashcat/John export and third-party modules.
Request a quoteUS dollars, excluding tax. Seat discounts: 2+ seats: 8% off; 5+ seats: 15% off. Free teaching licence for accredited courses (classroom use, not casework).
Compare editions
| Feature | Imager / Viewer | Recovery | Forensic | Complete |
|---|---|---|---|---|
| Acquisition and viewing | ||||
| Image disks, partitions and USB/flash media to raw (dd) or .ivi with a per-sector read map | Included in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Failing-drive imaging: multi-pass strategies, retries, skip and resume, one-click failing-drive preset | Included in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Drive health: SMART, HPA/DCO hidden sectors, NVMe health | Included in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| ddrescue mapfiles in and out | Included in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Optical discs (CD, DVD, BD): every session and track, raw CD with subchannel; CloneCD, cue/bin and ISO export | Included in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Verify an image against its stored hashes | Included in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Open and browse existing cases, preview, hex view, export the reports they hold | Included in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Recovery | ||||
| Add images and mount every supported container, partition scheme and filesystem | Not in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Deleted files, orphans and lost-and-found | Not in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Partition recovery from each filesystem's own metadata | Not in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Signature carving with validation, unallocated-space scope and resume | Not in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Damaged volumes: automatic metadata-copy choice with the reason recorded, switchable | Not in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Checksum verification on read (Btrfs, ZFS, ReFS) and honest per-sector statuses | Not in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Volume Shadow Copies as browsable versions | Not in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Drive map, hex and structure viewer | Not in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Export recovered files with a manifest | Not in Imager / Viewer | Included in Recovery | Included in Forensic | Included in Complete |
| Forensic analysis | ||||
| Hashing (MD5, SHA-1, SHA-256, ssdeep, TLSH), hash sets, NSRL and VICS import | Not in Imager / Viewer | Not in Recovery | Included in Forensic | Included in Complete |
| Single-read content pass, processing profiles and a headless command line | Not in Imager / Viewer | Not in Recovery | Included in Forensic | Included in Complete |
| Keyword, pattern and regex search; indexed search | Not in Imager / Viewer | Not in Recovery | Included in Forensic | Included in Complete |
| YARA (YARA-X) over files; Sigma rules over Windows event logs | Not in Imager / Viewer | Not in Recovery | Included in Forensic | Included in Complete |
| Windows artifacts: registry, event logs, LNK, Prefetch, jump lists, USN journal, SRUM, shellbags and more | Not in Imager / Viewer | Not in Recovery | Included in Forensic | Included in Complete |
| E-mail (PST, MSG, EML), Office, PDF, SQLite, plist and archive expansion | Not in Imager / Viewer | Not in Recovery | Included in Forensic | Included in Complete |
| Timeline, gallery with visual similarity, tags, bookmarks and notes | Not in Imager / Viewer | Not in Recovery | Included in Forensic | Included in Complete |
| New reports in HTML, PDF and CSV; report packages to exchange findings | Not in Imager / Viewer | Not in Recovery | Included in Forensic | Included in Complete |
| Decryption and extensibility | ||||
| BitLocker (password, recovery key, .bek, VMK or FVEK) and LUKS1/LUKS2 | Not in Imager / Viewer | Not in Recovery | Not in Forensic | Included in Complete |
| F2FS per-file encryption | Not in Imager / Viewer | Not in Recovery | Not in Forensic | Included in Complete |
| Keys stored in the case, so locked volumes unlock again when the case reopens | Not in Imager / Viewer | Not in Recovery | Not in Forensic | Included in Complete |
| Hash export for Hashcat and John the Ripper (BitLocker, LUKS, ZIP); potfile import | Not in Imager / Viewer | Not in Recovery | Not in Forensic | Included in Complete |
| Third-party modules built with the Module SDK | Not in Imager / Viewer | Not in Recovery | Not in Forensic | Included in Complete |
RAID assembly is coming as a separate add-on and is not part of any edition.
How licensing works
Licensing is not built yet. These are the terms the paid editions will be sold under; the licence terms page has the detail.
- Perpetual
- You keep the right to use every version released while your maintenance is active.
- Maintenance
- The first year is included. Renewal is about 27% of the licence price a year: $269, $539 and $809 for Recovery, Forensic and Complete. A late renewal runs from the previous end date.
- After it ends
- Versions released before the end date keep working. A later version runs as the free viewer and says which version to install.
- Term licence
- One year for about 40% of the perpetual price, with updates for that year.
- Seats
- One licence per computer, movable between computers. 2+ seats: 8% off; 5+ seats: 15% off.
- Offline labs
- Activation will work by request file for computers that never connect. Examining evidence never needs a network.
- Your cases
- Without a valid licence the program runs as the free viewer, which opens, browses and exports every case.
Questions
Is the imager free for casework?
Yes, for any use including commercial and government casework, with no time limit and no account. It images disks, partitions, USB and flash media and optical discs, and opens existing cases.
Do you crack passwords?
No. Complete exports hashes for Hashcat and John the Ripper and reads the recovered password or potfile back, so your lab keeps the cracking setup it has.
Can I move up to a bigger edition later?
Yes. You pay the difference between the two licence prices and keep your maintenance end date.
Do you take purchase orders and work with resellers?
Yes. Write to sales@invitroforensics.com for a quote, a purchase order or a multi-seat licence.
Is there an academic licence?
Free teaching licence for accredited courses (classroom use, not casework). Write to sales@invitroforensics.com from your institution's address.