ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "FTK Imager"

From ForensicsWiki
Jump to: navigation, search
(FTK Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis is warranted.)
 
Line 1: Line 1:
FTK Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with AccessData® Forensic Toolkit® (FTK™) is warranted. FTK Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence.
 
  
With FTK Imager, you can:
 
 
·  Preview files and folders on local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.
 
 
·  Create forensic images of local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.
 
 
·  Preview the contents of forensic images stored on the local machine or on a network drive.
 
 
·  Export files and folders.
 
 
·  Generate hash reports for regular files and disk images (including files inside disk images).
 
 
 
  
 
IMPORTANT: When using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.
 
IMPORTANT: When using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.

Revision as of 13:42, 16 April 2006


IMPORTANT: When using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.