Image, a menu prompting the user to select a source drive popped up and I selected Physical Drive as shown below. The Fujitsu Hard-drive was selected in the next step, After selecting the source hard-drive to be imaged the next step is to choose a destination where the image will be stored. The next window also has check boxes that allow the user to verify the image after it is created and there is also an option to create directory listings of all files in the image.
The window shown above is where you choose what format you want to save the image in, you have a choice of Raw (dd), SMART, E01, or AFF. For this case Raw (dd) image format was chosen because this format is supported by most forensic analysis tools including EnCase, and FTK. The next screen prompts the user to enter information about the evidence that is about to be imaged, this includes important information like Case Number, Evidence Number, Examiner Name, and if the examiner wishes to include any notes pertaining to the case or the evidence there is a field that takes that information.
The image destination window is next and in this window the user chooses where to store the image, this can be a folder on the primary hard-drive, an external hard-drive, DVD or even to a network storage location or device. A name for the actual image file is entered in this window as well. Depending on the storage device that the image will be saved to, the user can choose to fragment or split the image into manageable chunks that could for example fit on a number of CDs or DVDs.
The Term Paper on Windows 7 Config
... click on it and choose Properties. In the Properties window, go to the Security tab and select the current user to view the permissions ... You can also create a system image of your computer. For more information, see How does Windows choose which files to back up? ... trying to change. Click Change and, in the next window, select the new drive letter you wish to represent the partition, then click ...
For this case the image was saved to the primary C drive and thus there was no need to split up the image into smaller chunks. After this step the image will be created wherever the user chose to create the image, below is the window showing the progress of the image creation. Verification results are then displayed after the image is created. FTK Imager uses both MD5 and SHA1 hashes. In our case the hashes from the image matched the hashes from the original hard-drive which means we have a perfect bit-stream copy.
