The Menu and Button tool bars can also be undocked. All the panes (except the Viewer) can be undocked from the program window and repositioned on your screen. After you create an image of the data, you can then use FTK to perform a complete and thorough forensic examination and create a report of your findings.įTK Imager Interface The FTK Imager interface window is divided into seven panes: the Evidence Tree, File List, Properties, Hex Value Interpreter, Custom Content Sources, and the Viewer. Two hash functions are available in FTK Imager: Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1). FTK Imager verifies that the image hash and the drive hash match when the image is created. You can also create a hash of the original image that you can later use as a benchmark to prove the integrity of your case evidence.
When you acquire computer evidence, you can use FTK Imager to create an image of the source drives or files.
ACCESSDATA FTK IMAGER USER GUIDE FREE
The forensic image is identical in every way to the original, including file slack and unallocated space or free space. To prevent accidental or intentional manipulation of the original evidence, FTK Imager makes a bit-for-bit duplicate This ensures that your operating system does not alter the hard drive when you attach it to your computer.įTK Imager is a data acquisition tool that can be used to quickly preview evidence and, if the evidence warrants further investigation, create a forensically sound image of the media. Important: When using FTK Imager to create a forensic image of a hard drive, be sure you are using a hardware-based, write-blocking device. Generate hash reports for regular files and disk images (including files inside disk images) Preview the contents of forensic images stored on the local machine or on a network driveĮxport files and folders from forensic images.
ACCESSDATA FTK IMAGER USER GUIDE ZIP
Preview files and folders on local hard drives, network drives, floppy diskettes, Zip disks, CDs, and DVDsĬreate forensic images of local hard drives, floppy diskettes, Zip disks, CDs, and DVDs FTK Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence. 9 10 11 11 14 18 18 19 20 22 22 23 23 24 25 26 26 27 27 28įTK Imager FTK® Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with AccessData Forensic Toolkit® (FTK) is warranted. Accessing the Fernico FAR System from Imager. Viewing the Logicube Forensic MD5 Hardware Information. Accessing the Logicube Forensic MD5 Internal Drive as a USB Drive. Formatting the Logicube Forensic MD5 Internal Hard Drive. Creating an Image File with the Logicube Forensic MD5. Third-Party Trademarks All third-party trademarks are the property of their respective owners.įTK Imager FTK Imager Interface.
LicenseManager is a trademark of AccessData Corp. FTK Imager is a trademark of AccessData Corp. iĪccessData Trademarks Forensic Toolkit is a registered trademark of AccessData Corp. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.ĪccessData Corp. export regulations or the laws of the country in which you reside. You may not export or re-export this product in violation of any applicable laws or regulations including, without limitation, U.S. reserves the right to make changes to any and all parts of AccessData software, at any time, without any obligation to notify any person or entity of such changes. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
0 kommentar(er)
