Virtual Forensics Suite

Recover lost files. Catch failing drives before they die. When a drive fails, gets wiped, or files vanish, Virtual Forensics Suite gets your data back. The rest of the time it watches your drives and PCs so you can replace a failing disk before it takes your data with it. One self-contained Windows application: disk recovery & forensics plus a full Windows / drive health check.

Mac drives (version 1.15.0)

• The main scan names every GPT partition by type, including Apple HFS+, APFS and Recovery partitions, so a Mac drive no longer looks empty.
• Tools ▸ Mac recovery (HFS+) lists and recovers files from Mac OS Extended (HFS+ / HFSX) volumes on a disk or an image, with their names, folders and dates. APFS (Macs from 2017 on) is not read yet.

Get your files back

• NTFS and exFAT recovery from drives with a lost or wiped partition table (read-only, structure-preserving).
• Deleted-file undelete and signature carving: 14 formats; ZIP (and so Office .docx / .xlsx / .pptx), RIFF/WAV, SQLite and ICO are carved to their exact length from their own headers.
• Recover from an image, file preview, and a "drive not detected" triage that captures a drive the moment it reappears.
• Read-only imaging to raw or E01 / EWF, with SHA-256 and source verification. E01 output is verified to open in Exterro FTK Imager 8.2 and libewf and to pass FTK's own Verify Drive/Image.
• E01 evidence imaging with the case number, evidence number and examiner written into the container.
• Linux filesystems (ext2 / ext3 / ext4): list and recover from drives Windows cannot open, even through a backup superblock when the primary is destroyed.
• Hex / sector viewer: raw bytes of any disk or image, with the fields of MBR, GPT, NTFS, exFAT, FAT and $MFT structures named. Read-only.
• Partition table recovery: rebuild a wiped MBR (or GPT) from the volumes' own boot records, after backing up the sectors it replaces.
• RAID recovery: reassemble RAID 0 / 1 / 5 from the member disks, with a failed RAID 5 disk rebuilt from parity.
• Network recovery: read a disk on another machine over TLS with a pinned certificate; the agent is read-only.
• Chain of custody: hashes, manifests, a tamper-evident audit log and case reports.
• WinPE rescue media builder for PCs that won't boot.
• Whole-disk cloning and image restore (sector-exact; refuses the system disk or a target holding data) and partition resizing to grow into a bigger drive. A cloned disk has not yet been boot-tested.
• Memtest86+ boot media for testing memory on any PC. Not yet tested on hardware; the app says so before anything is written.

Keep PCs & drives healthy

Includes Virtual Windows Health Check. The Windows health check in this suite is also sold on its own as Virtual Windows Health Check ($75). If you buy Virtual Forensics Suite, you already have it; do not buy both.

• SMART verdicts (HDD / SSD / NVMe) with a predictive-failure horizon and drive age / wear.
• Whole-PC checks: storage, security, hardware, resilience, performance (including processes stuck burning a CPU core) and battery.
• History & trend, background tray monitoring, CSV / JSON export and fleet collection.
• vfcli and vwhc command-line tools for automation and the WinPE payload.

Why it's trustworthy

• Read-only where it matters: recovery, imaging and analysis open sources without a write handle, and imaging re-verifies the source hash. Writing is confined to the clone tools.
• Works offline: no account and no phone-home, and the license is checked on the computer itself. The only optional connections are an update check you can configure and fleet reporting you choose to send (--post).
• Self-contained: one installer bundles the .NET runtime and smartctl; nothing else to install.

Requires: Windows 10 / 11 (64-bit), Administrator. No prerequisites: the installer bundles everything.

The installer is signed with our own (self-signed) certificate, so Windows shows Unknown Publisher on first run.

Choose Free 7-day trial: every feature works for 7 days. After buying, send the computer code the app shows with your order number; you receive an unlock key for that computer that does not expire. If Windows is reinstalled or the system drive is replaced, the computer code changes and the key is reissued for the new code. Checkout asks you to sign in with your email (a one-time code, no password).

This product includes third-party software; see THIRD-PARTY-NOTICES.txt.

© 2026 Virtual Control LLC. All rights reserved. Made by Virtual Control LLC. Sold by SavageBiz at savagebiz.com.