Unit 1: Computer Forensics Fundamentals 1.3 Activity and Discussion Activity: Using FTK Imager

ACTIVITY: USING FTK IMAGER

Time: This activity should take you approximately 30 minutes if you use a small USB drive.

SOFTWARE

To complete this activity, you will have to download software.

• FTK Imager Lite

USB DRIVE

For this activity, you will need a USB drive as described in the Downloads and Supplies page on the top toolbar.

GOAL

We have learned that bitstream copies make a bit-for-bit copy of all sectors on a drive. In this activity, you will use a well-known forensics imaging tool, FTK Imager, to create a bitstream image of your USB drive and examine the results.

You may want to review the FTK Imager demonstration video before beginning this activity.

NOTE: FTK Imager does not guarantee that data is not written to the drive during imaging. For this reason, investigators will use a write blocker when using FTK Imager in a real case. To complete this activity, you can assume that you have a USB write blocker.

INSTRUCTIONS

Launch FTK imager and insert your USB.

Following the steps from the FTK Imager demonstration video, create an image of your USB drive in Raw (dd) format and save the copy to your desktop.

Summary of steps

• Select File -> Create Disk Image...
• Choose Physical Drive
• Choose your USB Device
• Press Finish.
• Add the image destination.
• Select Raw (dd) as format.
• Provide destination folder and image filename information.
• Press Start

Load the image you created to FTK imager, and examine the content.

Interested students can explore other features supported in FTK Imager.

转载于:https://www.cnblogs.com/sec875/articles/10013372.html