Solution Guide

Ingest 59
8 From the Refine Index window, include and exclude different types of data
from the indexing process.
9 Click Next .
Add Evidence
1 Click Add Evidence . The Add Evidence to Case pop-up appears.
2 Select the type of evidence to add to your case: Acquired Image of Drive ,
Local Drive , Contents of a Folder , or Individual File by selecting the radio
button. Then click
Continue .
3 Navigate to the image, drive, folder, or file; select the file and click Open .
If you selected Acquired Image of Drive as your evidence type, an
Evidence Information
pop-up will appear. Enter the requested information
and click
OK .
If you selected Local Drive as your evidence type,
a The Select Local Drive pop-up appears. Select the local drive you want
to add; then select either
Logical Analysis or Physical Analysis . Click
OK .
b In the Evidence Information window, enter the required information;
then click
OK .
If you selected Contents of a Folder or Individual File , select the folder or
file you want to add to your case; then click
Open .
4 Click Next .
5 In the New Case Setup is Now Complete window, review your selections.
Then click
Finish .
Ingest Using FTK 3 Lab Edition
Create an Image of the Target Storage Device
See "Create an Image of the Target Storage Device" on page 57.
Create a Case
1 Click Case → New . The New Case Options window appears.
2 Enter your case name and any reference or description information required
by your agency.