FTK Imager Lite does not require any files to be installed on the host computer. Several files are required to run off of the USB device in order to launch FTK Imager Lite from the USB device. 7. Test Procedure Acquire an image of a physical disk without making any changes to the – data on the disk Launch FTK Imager Lite on host machine. Connect test device with known files on it to the forensic machine. Hash the original device by clicking and then Evidence Item”. “File” “Add Click Drive”. “Physical “Next”. Select the physical disk that is the known test media. Right click the physical drive represented in the left hand column titled Tree”. “Evidence Select Drive/Image…”. “Verify Maintain screenshot of this MD5 and SHA1 hash as a baseline for the rest of the test procedure. Remove this as an evidence item after the hash is obtained by clicking and then “File” “Remove all Items” or alternatively click the icon in the toolbar for this command. Click and Disk Image”, or alternatively click the gray disk image icon in the toolbar. “File” “Create Select Drive”. “Physical Select the physical disk to be imaged from the drop down menu. “Finish”. In the Create Image dialog box, ensure that the boxes for images after they are created”, “verify progress statistics”, and create directory listings of all files in the image after they “precalculate are created” are checked. Select the type of disk image to be created (e.g., dd, EO1, SMART, etc.). “Next” Enter [Agency Name] unique case number (mandatory), evidence number (mandatory), unique description (optional), examiner (mandatory), notes (optional). Click “Next”. and select the destination for the forensic image. This should be placed on an “Browse” appropriately prepared piece of media. Provide the image file a name according to appropriate naming conventions. Provide a fragment size (if necessary). Select the compression ratio (if applicable). Click “Finish” The image process should begin and will end with a window showing the pre and post MD5 and SHA1 hash values of the network resource.
FTK Imager Lite does not require any files to be installed on the host computer. Several files are required to run off of the USB device in order to launch FTK Imager Lite from the USB device. 7. Test Procedure – Acquire an image of a physical disk without making any changes to the data on the disk Launch FTK Imager Lite on host machine. Connect test device with known files on it to the forensic machine. Hash the original device by clicking “File” and then “Add Evidence Item”. Click “Physical Drive”. “Next”. Select the physical disk that is the known test media. Right click the physical drive represented in the left hand column titled “Evidence Tree”. Select “Verify Drive/Image…”. Maintain screenshot of this MD5 and SHA1 hash as a baseline for the rest of the test procedure. Remove this as an evidence item after the hash is obtained by clicking “File” and then “Remove all Items” or alternatively click the icon in the toolbar for this command. Click “File” and “Create Disk Image”, or alternatively click the gray disk image icon in the toolbar. Select “Physical Drive”. Select the physical disk to be imaged from the drop down menu. “Finish”. In the Create Image dialog box, ensure that the boxes for “verify images after they are created”, “precalculate progress statistics”, and create directory listings of all files in the image after they are created” are checked. Select the type of disk image to be created (e.g., dd, EO1, SMART, etc.). “Next” Enter [Agency Name] unique case number (mandatory), evidence number (mandatory), unique description (optional), examiner (mandatory), notes (optional). Click “Next”. “Browse” and select the destination for the forensic image. This should be placed on an appropriately prepared piece of media. Provide the image file a name according to appropriate naming conventions. Provide a fragment size (if necessary). Select the compression ratio (if applicable). Click “Finish” The image process should begin and will end with a window showing the pre and post MD5 and SHA1 hash values of the network resource.
CIRT-Validation-Manual-1.docx