Forensically sound acquisition, without the forensics degree.

Write protection reported honestly, not rounded up.

Every device is software write-blocked by default, and on request the software attempts a real write and shows it being refused, rather than asking you to just trust it. Floppy disks go further: the read path issues no write commands at all, so they're read-only by physics, not just by software policy.

This is software write-blocking, verified by attempt — never dressed up as hardware-grade. We'd rather tell you what the product couldn't do than round a claim up.

Resuming means re-checking, not trusting an offset.

Device imaging (HDD, SSD, USB) resumes from its last verified checkpoint if interrupted, re-authenticating what's already copied against recorded hashes before continuing — rather than seeking to an offset and trusting what's there. Bad-block and read-error handling runs on every read, and errors are logged, not silently skipped.

Custody documented from intake, not reconstructed afterward.

Everything belongs to a case — client, references, items of media, images, exports, reports, activity log. No loose files. A guided imaging wizard registers the physical item (ID, label, condition), safety-checks the device, images it, then moves to the next disk.

An append-only activity log — human-readable and JSONL — records every action live in the UI. A completed case is sealed with a signed integrity manifest covering every file in it; the log records when sealing starts and confirms success or failure afterwards, and never claims "sealed" before the work is actually done.

Not locked to one tool.

Standard, interoperable evidence containers — RAW/DD today, with E01 and AFF4 planned — so output isn't locked into DF Sentinel itself. Before-and-after hash verification proves an image matches its source, with dual hashing throughout acquisition.

The last resort, in the same building.

DF Sentinel is built for media in working condition or with minor damage — that's the honest scope of any imaging tool. Behind it sits Data Forensics' full recovery lab, handling the failures software can't touch: seized drives, head crashes, degraded platters, fire and water damage, failed RAID and NAS arrays, media nothing else will read. If a disk is beyond software, it isn't beyond help — the same team simply takes it further, in-house, with the same chain of custody. DF Sentinel Guard and the lab share one standard, not two.

Questions from forensics & legal teams.

More from DF Sentinel.