Download
Install
- tar -C /usr/local/sbin -xvzf ftkimager.3.1.1_ubuntu64.tar.gz
Image erstellen
- ftkimager /dev/sdb /share/forensic/win10 --e01 --case-number 01 --evidence-number 01 --description secure.local.forensic --examiner tw,ng --notes first-run
Beschreibung
Optionen
| /dev/sdb
|
Quelle
|
| /share/forensic/win10
|
Ziel
|
| --e01
|
Format
|
| --case-number 01
|
Fallnummer
|
| --evidence-number 01
|
Beweisnummer
|
| --description secure.local.forensic
|
Beschreibung
|
| --examiner tw,ng
|
Ermittler
|
| --notes first-run
|
Notizen
|
Resultat
[/share/forensic]
└─# ls
win10.E01 win10.E01.txt
Quelle