I have personally used Helix and it works nice. Its a live CD which boots in write-protect mode and does help in acquiring the evidence and also perform other functions like hashing etc. Winhex is...