FTK IMAGER (FORENSIC TOOL) PART-2

 FTK IMAGER

Link for the first part of this blog:-https://careertechnologycybersecurityindia.blogspot.com/2023/08/ftk-imager-forensic-tool.html

Steps to create Disk Image using FTK Imager:-

Step1:-In the FTK Imager main window, under the "File" menu, select "Create Disk Image."

Step2:-Select "Contents of a folder" option and then click "Next".

Step3:-Click "Yes".

Step4:-On your device, create two new folders within any drive. Create one folder named "Input" and another named "Output." Place the data for which you intend to create a disk image into the "Input" folder.

Step5:-A new window will open. In the "Select Drive" section, choose the drive or device you want to create an image of. 

Step6:-Click the "Add" button to add it to the list.

Step7:-Fill in the required details and click "Next".

Step8:-In the "Image Destination" section, specify where you want to save the disk image. Click the "Browse" button to navigate to the destination folder and provide a name for the image file and then click "Finish".

Step9:- Once you've configured the settings, click the "Start" button to begin the imaging process.

Step10:-Simply close both the tabs, evidence files are ready.

Step11:-Once the image is successfully created, you can browse and access the contents of the disk image within FTK Imager. Go to "File" menu and select "Add Evidence Item".

Step12:- To load the image, select "Image File" option.

Step13:-Indicate the location of the evidence file that has been generated. (Select the AD1 file for image.)

Result:-

Step14:-Indicate the location of the evidence file that has been generated. (Select the "Text Document" file for text report.)

Result:-

              Remember that disk imaging is a critical process in digital forensics, so it's crucial to follow best practices and legal guidelines, especially if you're dealing with evidence for legal cases. Always consult with a qualified expert or legal authority if necessary.