FTK Imager

on June 21, 2023

The FTK Imager tool can collect forensically sound copy of hard drives and analyze those images.

What this tool can accomplish

  1. Dumping RAM
  2. Taking foresnically sound disk images
  3. Exports files from those images
  4. Generates MD5 and Sha1 hashes
  5. Providing read-only views of the images

How to Dump Ram in FTK Imager

  1. File> Capture Memory
  2. Enter location
  3. <Optional> Create AD1 file (this is the signature file type for FTK)
  4. Click Capture memory

Hard Drive Imaging

  1. Click File
  2. Create Disk Image
  3. Select your drive
  4. This now prompts for Evidence info (great for Chain of custody)
  5. Assign output destination
  6. Set image fragment size to 0. This means it wont be split into smaller segments
  7. Click Finish