vistalop.blogg.se

You can also select an Image File to view an image file you created before or Contents of a Folder, to look at a specific folder. You can select Physical Drive or Logical Drive (as we noted before, a physical device can contain more than one logical drive). Source Evidence Type: The first step is to identify the source type that you want to review. In this case we’ll add a single evidence item. You can also select Add All Attached Devices to add all of the attached physical and logical devices (If no media is present in an attached device such as a CD- or DVD-ROM or a DVD-RW, the device is skipped). Let’s take a look at that image as an evidence item.įrom the File menu, you can select Add Evidence Item to add a single evidence item to the evidence tree. Last week, I created an image of one of my flash drives to illustrate the process of creating an image. This week, let’s discuss how to add evidence items with FTK Imager for the purpose of reviewing the contents of evidence items, such as physical drives or images that you’ve created. Then, last week, we discussed how to create a disk image. A couple of weeks ago, we talked about the benefits and capabilities of Forensic Toolkit (FTK) Imager, which is a computer forensics software application provided by AccessData, as well as how to download your own free copy.