TrueBack is a cyber forensic software tool for disk imaging, developed by Centre for Development of Advanced Computing(C-DAC), Thiruvananthapuram. TrueBack is a DOS application for disk imaging. It will be supplied on a DOS Boot Floppy / CD. The investigating officer will be booting the suspect’s system from the boot floppy / CD supplied to him.

Trueback provides facilities for registering new user accounts with the analysis system prior to an analysis session. An already existing user can login into the system using the username and password entered at the time of registration. It also provides facilities to start a new analysis session or to open an already saved analysis session. A new analysis session is started by opening an evidence file into the analysis environment. Findings in an analysis session can be saved on to a probe file with .PRB extension and it can be used for subsequent analysis sessions.