Digital Forensics and Incident Response - Second Edition

Imaging using FTK Imager

The following process uses a hard drive and FTK Imager to produce a forensically sound image for analysis. Rushing or deviating from these steps may create a situation where the responder may not be able to rely on the evidence's integrity, thereby making potential evidence unreliable:

1. The first step is to physically inspect the evidence. There are two primary focal points that should be inspected. The first is the chain of custody form. Any time that you are taking custody of evidence, you should have access to the form, ensure that all steps are properly documented, and complete the entry with your information.
2. Then, you need to inspect the evidence packaging to ensure that any seals have not been breached. One ...