Book Image

Computer Forensics with FTK

By : Fernando Carbone
Book Image

Computer Forensics with FTK

By: Fernando Carbone

Overview of this book

<p>With the increase of electronic crimes and the need to constantly audit the proper use of resources, companies need qualified professionals and appropriate tools to carry out these activities. The FTK platform, with the ability to collect and analyze digital evidence quickly and with integrity, is a great solution to help professionals achieve these goals. It is extremely useful for conducting digital investigations, helping you conduct a thorough investigation through a single tool and ensure the integrity of evidence. It is hard to find technical information on this tool and that’s where this book will come in handy, helping professionals perform their activities with greater excellence.</p> <p>This tutorial leads by example, providing you with everything you need to use FTK and the tools included such as FTK Imager, Registry View, and PRTK in order to enhance your Computer Forensics knowledge in an easier and more efficient way.</p> <p>You will be introduced to the background of Computer Forensics, which include the types of digital devices that can be acquired and how to prepare for a new case of investigation. You will become acquainted with the FTK architecture and learn how to leverage its features in order to help you find the evidence as fast as possible. Through this book, you will also learn the memory forensics technique using the memory dump feature of FTK Imager. Furthermore, you will learn how to extract some important information such as process and DLL information, Sockets, and Driver List Open Handles.</p> <p>To conclude your tutorial, you will learn how to extract information from Windows Registry and how to recover passwords from the system and files. You will find this book an invaluable supplement to teach you all the steps required for the completion of investigations on digital media and to generate consistent and irrefutable evidence in court.</p>
Table of Contents (14 chapters)
Computer Forensics with FTK
Credits
About the Author
About the Reviewers
www.packtpub.com
Preface
Free Chapter
1
Getting Started with Computer Forensics Using FTK
Index

Mounting compound files


To locate important information during your investigation, you should expand individual compound file types. This lets you see the child files that are contained within a container, such as ZIP or RAR files. You can access this feature from the case manager's new case wizard, or from the Add Evidence or Additional Analysis dialogs.

The following are some of the compound files that you can mount:

  • E-mail files: PST, NSF, DBX, and MSG

  • Compressed files: ZIP, RAR, GZIP, TAR, BZIP, and 7-ZIP

  • System files: Windows thumbnails, registry, PKCS7, MS Office, and EVT

    Note

    If you don't mount compound files, the child files will not be located in keyword searches or filters.

To expand compound files, perform the following steps:

  1. Do one of the following:

    • For new cases, click on the Custom button in the New Case Options dialog

    • For existing cases, go to Evidence | Additional Analysis

  2. Select Expand Compound Files.

  3. Click on Expansion Options….

  4. In the Compound File Expansions Options dialog, select...