Simple Imaging. Tactical Triage. Zero Clicks.

About IO: Imaging for Operations (IO) is a zero-click forensic imaging tool designed for use in high-stress environments. IO automatically enables a software write-block, detects changes to attached devices, and begins producing E01 images from connected target media without any user interaction. Furthermore, IO logs include critical device information that MEDEX (forensic) examiners require such as device type, model, name, size, geometry, MD5 and SHA1 hashes, the hardware serial number, the volume serial number for each partition, and the device VID/PID.

Additionally, IO was designed from the ground up to enable concurrent data processing and analysis alongside imaging. Without impacting total imaging time, IO produces triage reports that include total file counts and extracted geo-location information from JPEGs. Developers can expand IO’s capabilities through the API.

For instructions on using IO, please see the user manual.

For instructions on developing with IO, please see the developer guide.

Credit: IO was based upon a Cipher Tech internal summer intern project named KANT. KANT's authors included Noah (noahbkim), William (woodruffw), and AJ, all working under the oversight of Eric. The project was later rebranded, remastered, and brought to production by Cipher Tech's full-time engineering team. That team was primarily comprised of: Joe (ct-jzarrelli), Andrew (aziehl), and Mike.