Imaging Using FTK Imager

AccessData produces a commercial forensic examination program called the Forensic Toolkit, or FTK.  While the FTK examination program costs thousands of dollars, AccessData also offers a no-cost companion program called FTK Imager.  FTK Imager is more flexible than dd in that it allows the user to create images of physical disks, logical drives, CD/DVD drives, […]

Creating a Forensically-Sound Image

The first step in any forensic data recovery operation or computer forensic investigation is to create an exact duplicate of the media to be examined.  As a rule, in most cases analysis should never be performed on the original media, as the investigative process can make irrecoverable changes to the source data.  Since the original […]