FTK Imager

FTK Imager

January 24, 2017

As discussed in Craig Ball's Electronic Discovery Workbook, FTK Imager can be downloaded here for free.  FTK Imager is part of the Forensic Toolkit developed by AccessData.   FTK Imager allows you to create an image of a hard drive in different segments that can later be reconstructed.   It uses MD5 hash values to confirm that the data has been copied correctly. 

 

FTK Imager has many functions, but one of its more helpful ones it the ability to generate a list of hash value.   Just go to File . . . Add Evidence Item.   Select the type as the 'Contents of a folder' and the files in the folder will be loaded up.

 

 

 .   . . then simply go to File .  . . Export File Hash List and an Excel .csv file will be created showing the SHA1 and MD5 hash values of each file in the selected folder. 

 

 

 

Please reload

Contact Me With Your Litigation Support Questions:

seankevinoshea@hotmail.com

  • Twitter Long Shadow

© 2015 by Sean O'Shea . Proudly created with Wix.com