More Related Content
![First Responder Course - Session 10 - Static Evidence Collection [2004]](https://cdn.slidesharecdn.com/ss_thumbnails/publiccopy-10-staticevidencecollection-130419072255-phpapp02-thumbnail.jpg?width=640&height=640&fit=bounds)
Module 02 ftk imager
- 1. Computer Forensics –Mobile Forensics – Incident Response – Litigation Support
- 2. Module Objectives • DataStorage Media • Acquisition Tools − Software − Hardware • Image Formats • FTK Imager Interface − File System Support − File Properties and Interpreters − Right-click Menu Options • FTK Imager Functionality − Previewing and Triage − Acquisition − Conversion / Verification − Custom Content Images − Mounting Images − Acquire Memory
- 3. Data Storage Media Magnetic •Floppy Disk • Hard Drives • USB, PC Card, etc. • Zip & Tape Drives Optical • CD • DVD Alternative Media • MP3 Players • Tablets • Smartphones • Who Knows What …
- 4. Using FTK Imager Hardware WriteProtect Device Preview Triage Image Export Hash Convert
- 5. File System Support •FAT (12,16,32) • exFAT • NTFS • HFS (Macintosh) • Ext (Linux) • Reiser3 • CD/DVD • VXFS (Veritas) FTK Imager supports the following file systems:
- 6. Encrypted Disks • Belowis a lists of AccessData Imager-identified and analyzed Whole Disk Encryption (WDE) decryption products (these all require the examiner to enter the password, AccessData forensic products don’t “crack "these): • Recognized and Analyzed Whole Disk Encryption Formats • PGP® • Utimaco • Credant • Guardian Edge • SafeBoot • EFS • JFS • LVM • Vmware • LVM2 • UFS1 • UFS2
- 7. The Interface Menu Bar Viewer FileList Status Bar Properties / Hex Value Interpreter Evidence Tree View Toolbar
- 8. Properties FAT and NTFS•Varies by file system • Also shows image information Evidence Info
- 9. Properties MAC/HFS Varies by filesystem Linux/EXT
- 10.
- 11.
- 12. Right Click MenuOptions
- 13.
- 14.
- 15. Software Acquisition Process Hashingand Verification The goal is to make an Identical Bit-by-Bit Image The goal is to make an Identical Bit-by-Bit Image =
- 16. Image Formats • Raw-DD(.001) • SMART (.s01) • Encase (.e01) • AFF (.aff) • AD1 (.ad1) • ISO/CUE (.iso/.cue) Imager Can Read These Formats Imager Can Create These Formats
- 17. SelectView Source Verify thesource to be acquired, then Export Disk Image.
- 18.
- 19.
- 20. Single Source –Multi Image Create multiple image formats from a single source at once
- 21. Multi Source –Multi Image Create multiple images from multiple sources at once !!
- 22. CD / DVDImages Use the .CUE file to map sessions .CUE files .ISO files
- 23. Converting a DiskImage
- 24. Image Verification Encase /DD ?? Verified based on image format
- 25.
- 26. Custom Content Images •Can be from multiple sources • Can include Unallocated Space • Results in an .ad1 format image • Can include specific SID(s)
- 27.
- 28.
- 29. Export Files Select thefile Select the destination
- 30.
- 31. Export File HashList
- 32.
- 33.
- 34.
- 35. Module Review • DataStorage Media • Acquisition Tools − Software − Hardware • Image Formats • FTK Imager Interface − File System Support − File Properties and Interpreters − Right-click Menu Options • FTK Imager Functionality − Previewing and Triage − Acquisition − Conversion / Verification − Custom Content Images − Mounting Images − Acquire Memory