Solution Guide

Ingest 57
Create an Image of the Target Storage Device
1 Within the AccessData FTK Imager application, click File → Create Disk
Image . . .
2 In the Select Source pop-up, select the type of evidence you want to image:
Physical Drive, Logical Drive, Image File, Contents of a Folder, or Fernico
Device, and click
Next .
NOTE: The following uses the Imaging a Physical Drive option to
demonstrate the image creation process.The other file options are covered in
the
FTK User’s Guide . See "Related Documentation and Resources" on
page 16.
3 Using the drop-down box, select the physical drive you want to image from
the available drives, then click
Finish .
4 In the Create Image pop-up, click Add . . . and select the type of image you
want to create (Raw, SMART, E01, or AFF). Then click
Next .
5 Enter the requested information in the Evidence Item Information window
(Case Number, Evidence Number, Unique Description, Examiner, and
Notes). Then click
Next .
6 In the Select Image Destination window, browse to the storage area
allocated for evidence images (see Figure 3-5 for Dell’s recommended file
and server nomenclature), enter an image filename, and then click
→
7 Click Start . The Creating Image . . . pop-up appears and provides a progress
bar of the operation.
NOTE: The image creation process can take hours depending on the volume
of data being added.
8 If you opted earlier to view a summary of the image results, the Drive/Image
Verify Results
window will appear when the image creation process
completes. Review the results, and then click
Close .
9 Click Close again to close the Creating Image . . . window.
Create a Case
1 Click File → New Case . Enter the following: Investigator Name , Case
Number
, Case Name , Case Path , and Case Folder .
2 In the Forensic Examiner Information window, enter the following:
Agency/Company , Examiner’s Name , Address , Phone , Fax , E-Mail , and
Comments . Then click Next .