{"product_id":"virtual-forensics-suite","title":"Virtual Forensics Suite","description":"\u003cp\u003e\u003cstrong\u003eRecover lost files. Catch failing drives before they die.\u003c\/strong\u003e When a drive fails, gets wiped, or files vanish, Virtual Forensics Suite gets your data back. The rest of the time it watches your drives and PCs so you can replace a failing disk \u003cem\u003ebefore\u003c\/em\u003e it takes your data with it. One self-contained Windows application: disk recovery \u0026amp; forensics plus a full Windows \/ drive health check.\u003c\/p\u003e\n\u003ch3\u003eMac drives (version 1.15.0)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe main scan names every GPT partition by type, including Apple HFS+, APFS and Recovery partitions, so a Mac drive no longer looks empty.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eTools ▸ Mac recovery (HFS+)\u003c\/strong\u003e lists and recovers files from Mac OS Extended (HFS+ \/ HFSX) volumes on a disk or an image, with their names, folders and dates. APFS (Macs from 2017 on) is not read yet.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eGet your files back\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eNTFS and exFAT recovery\u003c\/strong\u003e from drives with a lost or wiped partition table (read-only, structure-preserving).\u003c\/li\u003e\n\u003cli\u003eDeleted-file \u003cstrong\u003eundelete\u003c\/strong\u003e and signature \u003cstrong\u003ecarving\u003c\/strong\u003e: 14 formats; ZIP (and so Office .docx \/ .xlsx \/ .pptx), RIFF\/WAV, SQLite and ICO are carved to their exact length from their own headers.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecover from an image\u003c\/strong\u003e, file preview, and a \u003cstrong\u003e\"drive not detected\" triage\u003c\/strong\u003e that captures a drive the moment it reappears.\u003c\/li\u003e\n\u003cli\u003eRead-only imaging to raw or \u003cstrong\u003eE01 \/ EWF\u003c\/strong\u003e, with SHA-256 and source verification. E01 output is verified to open in Exterro FTK Imager 8.2 and libewf and to pass FTK's own Verify Drive\/Image.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eE01 evidence imaging\u003c\/strong\u003e with the case number, evidence number and examiner written into the container.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eLinux filesystems\u003c\/strong\u003e (ext2 \/ ext3 \/ ext4): list and recover from drives Windows cannot open, even through a backup superblock when the primary is destroyed.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eHex \/ sector viewer\u003c\/strong\u003e: raw bytes of any disk or image, with the fields of MBR, GPT, NTFS, exFAT, FAT and $MFT structures named. Read-only.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePartition table recovery\u003c\/strong\u003e: rebuild a wiped MBR (or GPT) from the volumes' own boot records, after backing up the sectors it replaces.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRAID recovery\u003c\/strong\u003e: reassemble RAID 0 \/ 1 \/ 5 from the member disks, with a failed RAID 5 disk rebuilt from parity.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNetwork recovery\u003c\/strong\u003e: read a disk on another machine over TLS with a pinned certificate; the agent is read-only.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eChain of custody\u003c\/strong\u003e: hashes, manifests, a tamper-evident audit log and case reports.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWinPE rescue media\u003c\/strong\u003e builder for PCs that won't boot.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWhole-disk cloning and image restore\u003c\/strong\u003e (sector-exact; refuses the system disk or a target holding data) and \u003cstrong\u003epartition resizing\u003c\/strong\u003e to grow into a bigger drive. A cloned disk has not yet been boot-tested.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eMemtest86+ boot media\u003c\/strong\u003e for testing memory on any PC. Not yet tested on hardware; the app says so before anything is written.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eKeep PCs \u0026amp; drives healthy\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003eIncludes Virtual Windows Health Check.\u003c\/strong\u003e The Windows health check in this suite is also sold on its own as \u003cstrong\u003eVirtual Windows Health Check ($75)\u003c\/strong\u003e. If you buy Virtual Forensics Suite, you already have it; do not buy both.\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eSMART\u003c\/strong\u003e verdicts (HDD \/ SSD \/ NVMe) with a \u003cstrong\u003epredictive-failure\u003c\/strong\u003e horizon and drive age \/ wear.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWhole-PC checks\u003c\/strong\u003e: storage, security, hardware, resilience, performance (including processes stuck burning a CPU core) and battery.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eHistory \u0026amp; trend\u003c\/strong\u003e, background tray monitoring, CSV \/ JSON export and \u003cstrong\u003efleet collection\u003c\/strong\u003e.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003evfcli\u003c\/strong\u003e and \u003cstrong\u003evwhc\u003c\/strong\u003e command-line tools for automation and the WinPE payload.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eWhy it's trustworthy\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eRead-only where it matters\u003c\/strong\u003e: recovery, imaging and analysis open sources without a write handle, and imaging re-verifies the source hash. Writing is confined to the clone tools.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWorks offline\u003c\/strong\u003e: no account and no phone-home, and the license is checked on the computer itself. The only optional connections are an update check you can configure and fleet reporting you choose to send (--post).\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSelf-contained\u003c\/strong\u003e: one installer bundles the .NET runtime and smartctl; nothing else to install.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eRequires:\u003c\/strong\u003e Windows 10 \/ 11 (64-bit), Administrator. No prerequisites: the installer bundles everything.\u003c\/p\u003e\n\u003cp\u003eThe installer is signed with our own (self-signed) certificate, so Windows shows \u003cem\u003eUnknown Publisher\u003c\/em\u003e on first run.\u003c\/p\u003e\n\u003cp\u003eChoose \u003cstrong\u003eFree 7-day trial\u003c\/strong\u003e: every feature works for 7 days. After buying, send the computer code the app shows with your order number; you receive an unlock key for that computer that does not expire. If Windows is reinstalled or the system drive is replaced, the computer code changes and the key is reissued for the new code. Checkout asks you to sign in with your email (a one-time code, no password).\u003c\/p\u003e\n\u003cp\u003eThis product includes third-party software; see THIRD-PARTY-NOTICES.txt.\u003c\/p\u003e\n\u003cp\u003e© 2026 Virtual Control LLC. All rights reserved. Made by Virtual Control LLC. Sold by SavageBiz at savagebiz.com.\u003c\/p\u003e","brand":"Virtual Control LLC","offers":[{"title":"Full licence","offer_id":48924558786697,"sku":null,"price":200.0,"currency_code":"USD","in_stock":true},{"title":"Free 7-day trial","offer_id":48924558819465,"sku":null,"price":0.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0622\/2210\/6761\/files\/virtual-forensics-shopify-2048.png?v=1794072804","url":"https:\/\/savagebiz.com\/products\/virtual-forensics-suite","provider":"SavageBiz","version":"1.0","type":"link"}