Difference between revisions of "FTK Imager"

From ForensicsWiki
Jump to: navigation, search
m (Reverted edit of Porker, changed back to last version by Ocarroll)
Line 1: Line 1:
 +
FTK Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with AccessData® Forensic Toolkit® (FTK™) is warranted. FTK Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence.
  
 +
With FTK Imager, you can:
 +
 +
·  Preview files and folders on local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.
 +
 +
·  Create forensic images of local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.
 +
 +
·  Preview the contents of forensic images stored on the local machine or on a network drive.
 +
 +
·  Export files and folders.
 +
 +
·  Generate hash reports for regular files and disk images (including files inside disk images).
 +
 +
  
 
IMPORTANT: When using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.
 
IMPORTANT: When using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.

Revision as of 12:55, 16 April 2006

FTK Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with AccessData® Forensic Toolkit® (FTK™) is warranted. FTK Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence.

With FTK Imager, you can:

· Preview files and folders on local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.

· Create forensic images of local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.

· Preview the contents of forensic images stored on the local machine or on a network drive.

· Export files and folders.

· Generate hash reports for regular files and disk images (including files inside disk images).


IMPORTANT: When using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.