I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source solutions.

Provided that:

  • is an offline copy (the compromised disk is not live)
  • it's Linux based and uses partclone (or dd, but I'm not sure about that one)
  • with the help of the advanced options you can encrypt the copy, hash it and copy "empty" sector

In forensics, is the RAW filesystem of the image a requirement or is it not that important?

  • Legal forensics or simply incident analysis?
    – schroeder
    May 12, 2021 at 18:34
  • Mainly incident analysis but i would like to know if a clone imaged obtained that way could still represent a valid proof
    – Jack
    May 12, 2021 at 19:39
  • From a legal perspective I would assume that only the original disk can be seen as proof. All copies are just to be able to work with something without having to access and may be accidentally alter the original disk.
    – Robert
    May 12, 2021 at 19:59
  • @Robert, that is not correct - typically we work from copies to protect the original. But they need to be cloned using a forensically sound tool, chain of custody needs to be ensured etc.
    – Rory Alsop
    May 13, 2021 at 8:02

2 Answers 2


No Clonezilla is not a Forensic tool. Even using it for incident analysis is not recommended. Can it be useful, yes, but there are better free tools available for forensic and incident analysis.

Yes RAW filesystem is important. It's where all the deleted files and fragments exist.

  • Thanks for the answer! Could you please name a few of said softwares?
    – Jack
    May 13, 2021 at 11:10
  • @Jack - I'm not going to make specifc software recommendations. Instead I suggest you Google the following: open source forensics . May 13, 2021 at 16:33
  • Agreed, there are plenty of free tools to image. Most companies make their money on programs that process the image. Jun 5, 2021 at 14:06

No, Clonezilla is not a Forensically sound tool. It will skip information from slack space, if any. Try Guymager. It's Forensically sound, easy to use with a GUI. Multi-threading really saves a lot of time.


  • Imaging is generally I/O bound. Multithreading doesn't really make a difference. Jun 5, 2021 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .