I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source solutions.

Provided that:

  • is an offline copy (the compromised disk is not live)
  • it's Linux based and uses partclone (or dd, but I'm not sure about that one)
  • with the help of the advanced options you can encrypt the copy, hash it and copy "empty" sector

In forensics, is the RAW filesystem of the image a requirement or is it not that important?

  • Legal forensics or simply incident analysis? – schroeder May 12 at 18:34
  • Mainly incident analysis but i would like to know if a clone imaged obtained that way could still represent a valid proof – Jack May 12 at 19:39
  • From a legal perspective I would assume that only the original disk can be seen as proof. All copies are just to be able to work with something without having to access and may be accidentally alter the original disk. – Robert May 12 at 19:59
  • @Robert, that is not correct - typically we work from copies to protect the original. But they need to be cloned using a forensically sound tool, chain of custody needs to be ensured etc. – Rory Alsop May 13 at 8:02

No Clonezilla is not a Forensic tool. Even using it for incident analysis is not recommended. Can it be useful, yes, but there are better free tools available for forensic and incident analysis.

Yes RAW filesystem is important. It's where all the deleted files and fragments exist.

  • Thanks for the answer! Could you please name a few of said softwares? – Jack May 13 at 11:10
  • @Jack - I'm not going to make specifc software recommendations. Instead I suggest you Google the following: open source forensics . – user10216038 May 13 at 16:33
  • Agreed, there are plenty of free tools to image. Most companies make their money on programs that process the image. – user2320464 Jun 5 at 14:06

No, Clonezilla is not a Forensically sound tool. It will skip information from slack space, if any. Try Guymager. It's Forensically sound, easy to use with a GUI. Multi-threading really saves a lot of time.


  • Imaging is generally I/O bound. Multithreading doesn't really make a difference. – user10216038 Jun 5 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.