O'Reilly logo

Windows Forensics Cookbook by Scar de Courcier, Oleg Skulkin

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

How to do it...

Once Registry Viewer has been installed, navigate to it on your machine and double-click the icon to open the program. Open FTK Imager at the same time.

  1. In Imager, go to File > Obtain Protected Files.
Figure 6.14. Obtaining protected files
  1. In the small box that pops up, choose a destination folder for your files.
Figure 6.15. Choosing a destination folder

Note the warning about Imager getting the files from your own system. This is fine in an example like this, or as part of a practice case, but if it shows up when you're ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required