#Accessdata ftk imager create disk image how to#
#Accessdata ftk imager create disk image pdf#
#Accessdata ftk imager create disk image full#
#Accessdata ftk imager create disk image Pc#

In this lab this is the source device to acquire the image. The image above (Image 8) is an example of a Kingston USB memory with 8 GB. It will show more information about the hard disks. The best way to do it is by running the fdisk -l in the terminal. I recommend that youВ make completelyВ sure which is the target disk to get the image. To acquire the forensic image, check where the hard disk is mounted by typing ftkimager -list-drives.

#Accessdata ftk imager create disk image full#

To get the full help of FTK type ftkimager вЂ“help and you will see something like this (Image 6): Ubuntu recognizes and executes FTK, just type in the terminal ftkimager. Now you are able to run the program whereverВ you are. Moving FTK Imager CLI to execute anywhere In live mode just hit the Enter key, because there is no password. Download FTK, by default it goes to the Downloads folder.ДЎ. Follow this steps to take the program to the right location.ДЎ. The version I used was ењ†4, version for x86 processors is available too.ДЄfter downloading, the program itself does not execute because you have to move to a specific path.

The laptop did not respond, the only thing that worked was Ubuntu.ДЇirst thing, download FTK Imager for Linux ( ), looking for вЂњCommand Line Versions of FTKвЂќ. At this point, I want to tell you I tried to boot that laptop with several Linux forensic distributions like Kali, Caine and Deft, I didnвЂ™t try REMnux for instance. I used the latest release of Ubuntu Desktop 16.04 ( ). I tried switching a lot of configurations in the BIOS of that laptop, but the Mini Windows XP never booted, so I had to move to Linux. It comes with a light Windows XP version called вЂњMini Windows XPвЂќ and I planned to the use FTK Imager Lite for Windows ( ) which runs stable when I have to acquire the image in situ (visit to another place or when there are limitations to move the hard disk at your office). Well, I couldnвЂ™t connect the disk to any other device, so I decided to fire up the laptop using the Hirens Boot CD ( ). Until one day, a laptop with a Solid-State Drive (SSD) came to me, and it had more RAM than a hard disk (see the Image 1 below).

#Accessdata ftk imager create disk image Pc#

The way to get the image for me most times is by removing the disk of the pc and connect it to the forensic station using a write blocker device.

#Accessdata ftk imager create disk image how to#

The password may be stored in another location in the USB device (QR Code, Text file, etc.) or can be cracked using a wordllist (rockyou.txt) and libkeepass tool.Day by day, the profession of digital forensics implies a challenge about changes of technologies, here IвЂ™m going to explain how to acquire a forensic image using FTK Imager in command line interface (CLI) and Linux. Kdbx file is a crypted file containing passwords. Example of tools: oletools, OfficeDissector, 7-Zip. On Windows, a typical macro downloads a PowerShell script to %TEMP% and execute it. Also, search for VBA macro and extract it with a tool. They actually contain Objects and hide statistic data. Always unzip OOXML documents (DOCX, XLSX, PPTX) and ODT documents.

#Accessdata ftk imager create disk image pdf#

Display the structure of PDF to check if there are scripting languages like JavaScript. To read barcodes, use zbarimg command line. Generally, it is a PNG file that contains a URL or a password. Check if there is a barcode in the form of QR Code. Check the image fileвЂ™s metadata fields: comments, copyright strings, GPS location, etc. Here are some tips that may help you during your investigation: Microsoft's Office formats (RTF, OLE, OOXML).Image file formats (PNG, JPG, GIF, BMP).Thus, you need to prepare the recommended tools for analyzing each format: When exploring the image content, it is important to analyze all data in all formats.