{"id":842,"date":"2020-10-01T11:25:20","date_gmt":"2020-10-01T10:25:20","guid":{"rendered":"https:\/\/cybercop-training.ch\/?p=842"},"modified":"2020-10-01T11:25:20","modified_gmt":"2020-10-01T10:25:20","slug":"disk-forensics-p8","status":"publish","type":"post","link":"https:\/\/cybercop-training.ch\/?p=842","title":{"rendered":"Disk Forensics P8"},"content":{"rendered":"

All good things are three, or maybe four? After learning how to acquire a disk Image with dd<\/a>, dcfldd<\/a> and ewfacquire<\/a> there is another way to do the same.<\/p>\n

\n

In this lab, the evidence hard disk is mounted on \u2018\/dev\/sdc\u2019. The\u00a0FTK Imager<\/b><\/a> is installed on the lab machine.<\/p>\n

Objective:<\/b>Create a disk image for evidence hard disk using FTK Imager tool.<\/p>\n<\/blockquote>\n

Like in the previous exercises I’ll made sure that the disk is not mounted<\/p>\n

\"\"<\/a><\/p>\n

umount \/dev\/sdc<\/code><\/p>\n

\"\"<\/a><\/p>\n

Let’s check the command switches, to see how we get the disk image<\/p>\n

ftkimager --help<\/code><\/p>\n

\"\"<\/a><\/p>\n

If I compare that with ewfacquire there are more command line swiches needed. Let’s go ahead<\/p>\n

ftkimager \/dev\/sdc evidence --e01 --case-number 102 --evidence-number 2 --description 'Acquired image for case number 102' --examiner 'Cybercop'<\/code><\/p>\n

\"\"<\/a><\/p>\n

ftkimager evidence.E01 --print-info<\/code><\/p>\n

\"\"<\/a><\/p>\n

\n

\n","protected":false},"excerpt":{"rendered":"

All good things are three, or maybe four? After learning how to acquire a disk Image with dd, dcfldd and ewfacquire there is another way […]<\/a><\/p>\n<\/div>","protected":false},"author":2,"featured_media":843,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,16],"tags":[],"class_list":["post-842","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-forensic","category-linux"],"_links":{"self":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/842","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=842"}],"version-history":[{"count":5,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/842\/revisions"}],"predecessor-version":[{"id":853,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/842\/revisions\/853"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/media\/843"}],"wp:attachment":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=842"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=842"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=842"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}