Disk acquisition with FTK Imager
1. Introduction
In this lab, the evidence hard disk is mounted on ‘/dev/sdc’. The FTK Imager is installed on the lab machine.
Create a disk image for evidence hard disk using FTK Imager tool.
2. Create Disk Image with FTK Imager
Like in the previous exercises we have to made sure that the target disk is not mounted
umount /dev/sdc
Let’s check the command switches, to see how we get the disk image
ftkimager --help
If I compare that with ewfacquire there are more command line swiches needed. Let’s go ahead
ftkimager /dev/sdc evidence --e01 --case-number 102 --evidence-number 2 --description 'Acquired image for case number 102' --examiner 'Cybercop'
ftkimager evidence.E01 --print-info
Last updated