You would be extremely surprised with all that you can find.
Accessdata ftk imager 3.4.3 software#
Accessdata ftk imager 3.4.3 Pc#
That being said though, keep in mind that you will absolutely need to use a write blocker before you connect anything to the PC to be imaged as data will be written to the drive you are wanting to image the second that it is connected to the PC. What is nice about this software is that it is very user friendly and just using the free version will be enough to do what you are looking for. One of the most popular and easiest to use in my opinion is FTK (both paid and free version).
For Windows, there are many products that can be used to capture an image. I am only going to mention Windows and Linux as that is what I am more familiar with, though OSX is very similar to Linux in this regard. When deciding on what OS to use to capture the image, you need to consider a couple things. You are only going to be imaging the drive and no analysis will be done.You have physical access to the drive and are going to be slaving the drive to a clean environment/workstation.You want anyone who comes behind you to be able to reproduce EVERY step you performed to capture the image, analyze the image, etc.The hashes of the drive to be imaged and the hashes of the image of the drive MUST BE THE SAME! You MUST ensure data integrity and the way to do that is by producing hashes that when compared are absolutely identical to each other.Meaning, you will have access to the physical drive and therefore will be able to slave it to a "forensic workstation" to capture the image. In your case, I am going to assume you would be performing a dead capture on the hard drive itself and the contents contained only within that hard drive.
Is the image going to be a live capture or a dead capture?.Whether you are using Windows, Linux, or OSX, you want to make damn sure that you are performing the image from a clean environment/machine and using some kind of write blocker (either hardware or software).It is crucial that you are using a "forensically sound environment".Whatever you use (I prefer Paladin - Linux or FTK - Windows, Linux, or OSX), there are 5 things, in my opinion, that you have to be aware of:
0 kommentar(er)
