Adepto created the forensic backup in around six minutes, but this backup was from a USB drive to another USB drive, while the others were from USB to IDE backups. Adepto used to have a bug verifying the forensic image hash, but in release 1.9, this appears to be fixed. Once the image is created, the next utility to use is Autopsy. Autopsy is a browser-based forensic and, unfortunately, this utility is just not feature-rich enough to compete with other pay products on the market. There are, however, some real strengths to Autopsy. For instance, it recovered the most deleted files among utilities tested, but there was no mechanism for searching for access-controlled files or steganographed files. While Autopsy could detect the presence of a deleted directory, we were unable to recover the contents of the directory.
There are many help files for using the Helix environment included on the CD. Instructions on how to maintain proper forensic procedure using Helix are also included. Internet searches should yield more.
The Helix bootable CD is free.