Abstract
Disk forensics is an essential area of information security aimed at examining digital storage devices to identify, recover, and analyze data relevant to investigations. This study focuses on the functionality and performance of modern tools for disk forensics analysis, with a primary emphasis on comparing the capabilities of programs such as EnCase and FTK Imager used in this field. The research includes an overview of existing methods and technologies underlying forensic tools, including the search for deleted files, recovery of file systems, metadata analysis, and detection of artifacts indicating traces of user activity. In addition to functional capabilities, the study evaluates the performance of the software, including data processing speed, the range of supported file formats, and the efficiency of handling large volumes of information. Special attention is paid to quality assessment criteria for the tools, such as data recovery accuracy, user interface, and support for task automation. The results of the study may be valuable for professionals in cybersecurity, forensic investigation, and IT administration, as well as for students and researchers studying digital forensics. The work aims to enhance understanding of the capabilities and limitations of modern disk analysis tools, facilitating the selection of optimal solutions for specific tasks.