O'Reilly logo

Computer Forensics with FTK by Fernando Carbone

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

The FTK Imager functionality

You can use FTK Imager to preview a piece of evidence prior to creating the image file(s). You can then choose to image the entire evidence object or choose specific items by selecting Add to Custom Content (AD1) image.

Adding and previewing an evidence item

You can either add a single evidence item or several items at one time. The following screenshot shows the procedure in a step-by-step format:

  1. Click on the Add Evidence Item button on the toolbar.
  2. Select the source type you want to preview and then click on Next.
    Adding and previewing an evidence item
  3. Select the drive or browse to the source you want to preview and then click on Finish:
  4. The evidence item appears ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required