P2 eXplorer

Examining hard disk drives is part of forensic analysis work and oftentimes access to the physical device is not possible. An alternative is to have the disk imaged and then mount the file in a specialized tool that can render its content.

P2 eXplorer is such a utility that can mount hard disk images into read-only virtual drives (write protection is enabled for preventing tampering with the evidence), allowing free exploration of the evidence with the file manager provided by Windows operating system.

Once launched, the program makes available a straightforward main application window that permits loading one or more image files that appear as separate drive in the file manager.

Every entry is accompanied by details referring to how the space is occupied; as such, the user is informed about the total capacity of the drive, the amount of free space available and the amount of used space.

P2 eXplorer can be used for loading an impressive number of disk images from various programs. It works with non-compressed WinImage files as well as with RAW images from Linux and other utilities.

Moreover, it can work with compressed and encrypted PFR (Paraben's Forensic Replicator) images and includes support for logical and physical types.

Additional functionality consists in MD5 checksum and hash verification for making sure that the file has not been changed in any way.

Even if the application is aimed at professionals it can be used by regular users, too. P2 eXplorer provides a simple interface and seamless mounting of the image file in the Windows environment, the data being available as if stored on a physical drive.