The version used for this posting was downloaded directly from the AccessData web site (FTK Imager version 2.6.0).įrom the File menu, select Create a Disk Image and choose the source of your image. The rest of this article will walk the reader through the process of taking a drive image using AccessData's FTK Imager tool.įTK Imager is a Windows acquisition tool included in various forensics toolkits, such as Helix and the SANS SIFT Workstation. The truth is: there are plenty of good tools that provide a high level of automation and assurance. I maintained my snobbish attachment to plain old dd for a long time, until I finally got tired of restarting acquisitions, forgetting checksums, and making countless other errors. There are many utilities for acquiring drive images.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |