FTK IMAGER
Link for the first part of this blog:-https://careertechnologycybersecurityindia.blogspot.com/2023/08/ftk-imager-forensic-tool.html
Steps to create Disk Image using FTK Imager:-
Step1:-In the FTK Imager main window, under the "File" menu, select "Create Disk Image."
Step2:-Select "Contents of a folder" option and then click "Next".
Step3:-Click "Yes".
Step4:-On your device, create two new folders within any drive. Create one folder named "Input" and another named "Output." Place the data for which you intend to create a disk image into the "Input" folder.
Step5:-A new window will open. In the "Select Drive" section, choose the drive or device you want to create an image of.
Step6:-Click the "Add" button to add it to the list.
Step7:-Fill in the required details and click "Next".
Step8:-In the "Image Destination" section, specify where you want to save the disk image. Click the "Browse" button to navigate to the destination folder and provide a name for the image file and then click "Finish".
Step9:- Once you've configured the settings, click the "Start" button to begin the imaging process.
Step10:-Simply close both the tabs, evidence files are ready.
Step11:-Once the image is successfully created, you can browse and access the contents of the disk image within FTK Imager. Go to "File" menu and select "Add Evidence Item".
Step12:- To load the image, select "Image File" option.
Step13:-Indicate the location of the evidence file that has been generated. (Select the AD1 file for image.)
Step14:-Indicate the location of the evidence file that has been generated. (Select the "Text Document" file for text report.)
Remember that disk imaging is a critical process in digital forensics, so it's crucial to follow best practices and legal guidelines, especially if you're dealing with evidence for legal cases. Always consult with a qualified expert or legal authority if necessary.
Comments
Post a Comment