ITT 593
Lab 4 : Imaging USB storage
Task 1 : FTK Imager
1. Download and install FTK imager from http://accessdata.com/product-download.
2. For this lab exercise, we will image a usb drive. Under File, click on Create Disk Image.
3. Select physical drive for the source evidence. Next, choose for the USB drive.
4. For Image type, select E01.
5. Next, fill in suitable information for the case.
6. Choose default setting for compression and none for encryption. Then, start the imaging
process.
TASK 2 : Verify the output
1. How do you verify the integrity and authenticity of the produced image?
2. Design and perform a simple experiment to compare the output of imaging and simple
copy and paste.
TASK 3 : Turning in your Project
1. Prepare a report of your findings. Add appropriate screen capture for significant steps and
output gathered.
2. Submit to ilearn
group forum