Simrip 3 (4K | FHD)

No tool is perfect, and SimRip 3 has its blind spots.

While SimRip 3’s native output format is a raw DD image (.img or .dd), it now includes experimental write support for EnCase’s E01 format and Advanced Forensic Format (AFF). This is a massive boon for forensic analysts who need compressed, segmented output without post-processing. simrip 3

A law enforcement investigator needed a forensically sound image of a 128GB USB drive. Using SimRip 3’s E01 output with compression: No tool is perfect, and SimRip 3 has its blind spots

simrip3 /dev/sdc ./evidence.E01 --format encase --compress 6 --hash sha256 --hash-output ./evidence.sha256

The resulting E01 file was ingested directly into FTK and EnCase without any conversion. The resulting E01 file was ingested directly into

SimRip 3 ships with both a GUI Dashboard and a CLI version. A typical extraction workflow:

The dashboard visualizes SIM memory allocation, showing free/used blocks and suspected residual sectors.