Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

This procedure outlines the process of a disk imaging acquisition of the tool FTK
Imager.
4.5.1 Prerequisites
1. Windows XP Professional with Service Pack 3 is installed in the system or
Windows 7 with latest system updates installed
2. Minimum data storage requirement for the program is met
4.5.2 Acquisition – FTK Imager (Windows Version - Common in most Test
Scenarios)
1. Connect the test hard drive to the Windows machine using the specified
physical interface. Connect to the hardware writeblocker if the test case is
required.
2. Log on the computer with administrator privilege.
3. Start FTK Imager (Under Windows 7, run the program as administrator)
4. Click “Add Evidence Item” and select physical drive
5. Choose the test drive and click Finish
6. Acquire Entire drive or single partition
a) Right click the physical drive and select “Export disk image”
b) Right click the partition that need to be acquired and select “Export
disk image”
7. Select verify image, precalculate progress and create directory listings and
Add image and choose image type either dd, E01 or Smart.
8. Input Case Number, Evidence Number, Description, Examiner and Notes.
9. Choose destination folder and input the desired image filename. Change
Image fragment size if necessary.
10. Then click finish to start disk acquisition.
11. Wait until FTK Imager indicates the acquisition progress is completed.
4.1 Acquisition – AIR
This procedure outlines the process of the disk imaging acquisition of the tool AIR.
4.6.1 Prerequisites
1. Uudecode program must be installed (use command “which uudecode” to
verify whether uudecode is installed)
146