Forensic Analysis Using FTK

Lab 3: Analysis Using FTK
Note: If you receive a warning that the directory already exists and click “Yes” to erase
it, click “Yes” because the evidence file will not be erased.
Click “Next” and fill in your name on the “Examiner Information” dialog and click
“Next.” Accept the defaults for the “Case Log” options by clicking “Next.” Accept the
defaults on “Processes to Perform” by clicking “Next.” Accept the defaults on “Refine
Case – Default” by clicking “Next.” Accept the defaults on “Refine Index – Default” by
clicking “Next.”
In the “Add Evidence” dialog box, click on “Add Evidence” and select “Acquired Image
of Drive” and click “Continue.” Navigate to the “Evidence” subdirectory you created:
KSU ISA4350 – Page 2 of 11