#Describe the accessdata ftk imager tool software

Creating a logical image is the best way to only capture the data in a folder, a nothing more. ItвЂ™s possible due to legal constraints you are are not allowed to capture anything more than the files located in a certain folder. a users mailbox, or a user directory on a server). device limitations) or when you just want to image a certain folder (e.g. These images are usually created when you are unable to create a physical image (e.g. Logical imageДЄ logical image is a file system level image. The system will perform exactly as if the original drive has been inserted. This can be extremely useful if you want to boot up the original system (e.g. Since a physical image is a bitstream copy of a storage device you will be able to write this image back to the other storage device and create an identical copy of the original. Norton Ghost, Acronis Trueimage).ДЄn other great вЂњfeatureвЂќ of a physical image is the possibility to write the image back to a disk.

#Describe the accessdata ftk imager tool software

This means you will be able to perform data recovery on this copy, something that is not possible with a normal copy or clone made by вЂњnormalвЂќ disk cloning software (e.g. Because a bit stream copy is a bit-by-bit copy of the original storage device it will also include the unallocated areas of a storage device. Physical imageДЄ physical image is a complete image of all the contents of a storage device, a so called bitstream copy.В A Bitstream copy involves the copy of all areas of a storage device. When creating the actual image, there are basically two types of images you can create. Never, in any case, should you be able to actually write to the evidence. Some write-blockers have a build in cache that enables you to вЂњwriteвЂќ to the device, all changes made are temporary however and only exist in the write-blocker.

This usually involves using a write-blocker, a device that enables the investigator to read the drive, but not write to it. There are several ways of creating a forensic copy, but they all have one thing in common. ItвЂ™s important however that you follow a strict set of procedures to ensure a proper forensically sound copy of the evidence is made. We are able to create a 100% identical copy of the evidence. And in digital forensics, we are able to something special. When you want to investigate a system you need to document everything you can about the system. The gold rule of forensic also applies to digital forensics. вЂњNever touch, change, or alter anything until it has been documented, identified, measured, and photographed.вЂќ I would highly recommend hiring an expert to perform any kind of forensic data acquisition. While it is possible to create a forensic image yourself. But I believe this subject deserves a more comprehensive explanation. A simple answer would be that a forensic image contains all data stored on a device. LetвЂ™s try it.A question I get asked a lot is вЂњwhat is a forensic image?вЂќ and what is the difference between an image made with tools like FTK Imager and Acronis true Image. That person can acquire the image and ship it to you and no one will be able to decrypt it, only you. Therefore, it is a safe method to give your public key to a person acquiring an image. He/she will not be able to decrypt it afterwards. A person who has access to the public key is allowed to encrypt the data, but since that person does not have the private key. Thus, only the person can see the saved data who has the private key.

In order to decrypt it later, you will need to apply the corresponding private key. In order to encrypt data, you will need the public key. The main idea is that you need to create two keys, one public and one private. Understanding Public Key Infrastructure ( PKI ) is very important and this exercise will help you understand it usage. In that case, you will allow the person acquiring the evidence physical access to the drive, but if you do not want that person to make a copy and later examine the image of the acquired drive, then youвЂ™ll need to protect it.

In some cases, you will have to collect evidence in a remote site or hire someone to collect the evidence for you.