Ftk Imager Handling

Download

• wget https://ad-zip.s3.amazonaws.com/ftkimager.3.1.1_ubuntu64.tar.gz

Install

• tar -C /usr/local/sbin -xvzf ftkimager.3.1.1_ubuntu64.tar.gz

Image erstellen

• ftkimager /dev/sdb /share/forensic/win10 --e01 --case-number 01 --evidence-number 01 --description secure.local.forensic --examiner tw,ng --notes first-run

Beschreibung

Optionen

/dev/sdb	Quelle
/share/forensic/win10	Ziel
--e01	Format
--case-number 01	Fallnummer
--evidence-number 01	Beweisnummer
--description secure.local.forensic	Beschreibung
--examiner tw,ng	Ermittler
--notes first-run	Notizen

Reslultat

[/share/forensic]
└─# ls                                                                                                                        
win10.E01  win10.E01.txt

Quelle

• https://it-dad.de/2019/03/13/ftk-imager-und-autopsy-unter-linux-nutzen/