How to do it...

Once Registry Viewer has been installed, navigate to it on your machine and double-click the icon to open the program. Open FTK Imager at the same time.

  1. In Imager, go to File > Obtain Protected Files.
Figure 6.14. Obtaining protected files
  1. In the small box that pops up, choose a destination folder for your files.
Figure 6.15. Choosing a destination folder

Note the warning about Imager getting the files from your own system. This is fine in an example like this, or as part of a practice case, but if it shows up when you're ...

Get Windows Forensics Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial