Ftk imager

http://andreafortuna.org/dfir/forensic-disk-images-of-a-windows-system-my-own-workflow/