# Disk acquisition with FTK Imager

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FwmJYhKS1jTrkYBAwr4Z4%2Fftk-678x381.png?alt=media\&token=38239c01-363b-4963-9cff-54c6b85c585c)

### 1. Introduction

> In this lab, the evidence hard disk is mounted on ‘/dev/sdc’. The [**FTK Imager**](https://accessdata.com/product-download/debian-and-ubuntu-x64-3-1-1) is installed on the lab machine.

Create a disk image for evidence hard disk using FTK Imager tool.

### 2. Create Disk Image with FTK Imager

Like in the previous exercises we have to made sure that the target disk is not mounted

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2Fxg2MVQ7gdCYGp5WwYKc0%2Fftk1.png?alt=media\&token=84c94b8b-98d9-4e13-ae8b-ccd3f2134b3a)

`umount /dev/sdc`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FfAepPkIRlUIAVkjbOsxt%2Fftk2.png?alt=media\&token=d1347335-42c1-4252-a7e7-61fbd289a40f)

Let’s check the command switches, to see how we get the disk image

`ftkimager --help`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FTZjVgMA0huPYoNmEnlVK%2Fftk3-1024x869.png?alt=media\&token=fab961d0-8de7-414f-acee-f425d0216616)

If I compare that with ewfacquire there are more command line swiches needed. Let’s go ahead

`ftkimager /dev/sdc evidence --e01 --case-number 102 --evidence-number 2 --description 'Acquired image for case number 102' --examiner 'Cybercop'`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2F9sB0PAAZUMtWOoGIs4Nz%2Fftk4-1024x538.png?alt=media\&token=7bd2d5e0-1dc2-4cd6-812a-949c92eae06a)

`ftkimager evidence.E01 --print-info`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FK2cXq58oUfPPYxb9aQZm%2Fftk5-1024x858.png?alt=media\&token=49b6146d-58d1-4d92-90a4-f9f78dd3fdee)