результаты тестирования программ для КТЭ
http://www.cftt.nist.gov/CFTT-Booklet-R ... 012012.pdf
ENCASE 6.5
If a logical acquisition is made of an NTFS partition, the last physical sector of the partition is not acquired
а вот это особенно воодушевляет: there may be a small number of differences in file system metadata between the image file and the restored partition
FTK IMAGER 2.5.3.14
The location of corrupted data in an image file is not reported