HOW TO USE ACCESSDATA FTK IMAGER HOW TO
HOW TO USE ACCESSDATA FTK IMAGER SOFTWARE
HOW TO USE ACCESSDATA FTK IMAGER WINDOWS

Raw Format Makes it possible to write bit-stream data to files Advantages Fast data transfers Can ignore minor data read errors on source drive Most computer forensics tools can read raw format Disadvantages Requires as much storage as original disk or data Tools might not collect marginal (bad) sectors Guide to Computer Forensics and InvestigationsД¦ Guide to Computer Forensics and Investigations Three formats Raw format Proprietary formats Advanced Forensics Format (AFF) Guide to Computer Forensics and InvestigationsДҐ Guide to Computer Forensics and Investigations

HOW TO USE ACCESSDATA FTK IMAGER HOW TO

Objectives List digital evidence storage formats Explain ways to determine the best acquisition method Describe contingency planning for data acquisitions Explain how to use acquisition tools Guide to Computer Forensics and InvestigationsД®xplain how to validate data acquisitions Describe RAID acquisition methods Explain how to use remote network acquisition tools List other forensic tools available for data acquisitions Guide to Computer Forensics and InvestigationsД¤ Understanding Storage Formats for Digital Evidence FTK Imager an вЂњexport hash listвЂќ feature, which can be used to export a list of the hashes (MD5 and SHA1 respectively) of all the files on the image.1 Guide to Computer Forensics and Investigations Third EditionДў Guide to Computer Forensics and Investigations Now you have an evidence item in the form of the image of the USB drive. To view the image, open up FTK Imager and click on вЂњadd evidence itemвЂќ and select your image file. Matching hash values provides integrity check This ensures that no data has been modified/written to the drive while the imaging process takes place (read: Write Blockers). 001 extension is the raw image of your physical USB drive.Дuring the imaging process FTK imager computes the MD5 and SHA1 hashes of the USB drive and of the image, and verifies that the hashes match. 001 extension and a text file with a summary of the image. Now open up the destination folder and check to see the image file with a.

Provide a destination folder where the image will be stored and image filename information.

Choose вЂњPhysical DriveвЂќ as itвЂ™s a physical drive youвЂ™re imaging.

Enter the File menu click on вЂњCreate Disk ImageвЂќ.

HOW TO USE ACCESSDATA FTK IMAGER WINDOWS

Plug the USB drive to Windows and launch FTK imager.ДЇollowing the following steps, create an image of your USB drive in Raw (dd) format and save the copy to your desktop. In this activity, we use FTK Imager a well known forensics imaging tool, to create a bitstream image of the USB drive. Try using one that is one GB or less so the imaging process doesnвЂ™t take too long.

HOW TO USE ACCESSDATA FTK IMAGER SOFTWARE

In this article iвЂ™m going to illustrate how you can image a drive using the FTK imager and by creating a bit stream copy (more on this later!) of the suspect machine.ДЎ) Windows software FTK Imager Lite from lite-version-3.1.1Дў) A USB stick with a files of different formats on it.

To actually view the contents of the suspect machine, it becomes necessary to image the hard disk as a part of evidence collection. Clearly hashing plays an important role here, but can only go so far as to provide confirmation of no modification to the data. Given that an incident occurs, it is imperative that evidence is collected without any modification to the suspect machine (for legal as well as investigative purposes). Hashing is the obvious solution when it comes to checking if data has been changed or modified in anyway. Here is a great resource on why passwords are hashed. It provides an integrity check for the data, meaning, the data hasnвЂ™t been tampered with in any way. Hashing is a core concept in all of information security. An important concept to be familiar with is that of a hash function. Correct procedure dictates that the evidence has to follow the chain of custody so that it isnвЂ™t tampered with, for example, the contents of the hard disk. When a cyber crime is reported (or unearthed), it becomes necessary to collect and gather the evidence in a forensically sound manner.

How to use accessdata ftk imager