Windows Forensics Cookbook

How to do it...

There are two ways of initiating the drive imaging process:

1. Using the Create Disk Image button from the toolbar (Figure 3.1)

Figure 3.1. Create Disk Image button on the toolbar

2. Using the Create Disk Image... option from the File menu (Figure 3.2)

Figure 3.2. Create Disk Image... option in the File Menu

You can choose whichever option you prefer.

The first window you see is Select Source. Here, you have five options:

• Physical Drive: This allows you to choose a physical drive as the source, with all partitions and unallocated ...