Course Curriculum

  • 01

    Introduction

  • 02

    Installation of FTK Imager

    • Required Files

    • Install FTK Locally

    • Install FTK on a Portable Device (USB)
  • 03

    Evidence Acquisition

    • Required Files

    • Digital Evidence Acquisition

    • Memory Acquisition

    • Disk Acquisition

    • Exercise #1

    • Solutions #1

    • Image Format Lab

    • Image Format Lab_Solution

    • Logical & Physical Lab

    • Logical & Physical Lab_Solution
  • 04

    Attach an Evidence Item

    • Required Files

    • Add Evidence Item to FTK Imager

    • Create and verify a multi-part disk images

    • Loading a multi-part disk image
  • 05

    Evidence Analysis

    • Required Files

    • Evidence Analysis

    • Exporting Data using FTK Imager

    • Detect EFS Encryption

    • Exercise #2

    • Solution Exercise #2
  • 06

    Acquiring Protected Registry Files

    • Acquiring Protected Registry Files

    • Copying Registry Files
  • 07

    Interpreter in FTK

    • Required Files

    • Interpreter

    • Exercise #3

    • Exercise#3 Solution
  • 08

    Create Images with Advanced Features

    • Required Files

    • Custom Content Images

    • AD Encryption

    • Exercise #4

    • Exercise#4 Solutions
  • 09

    Image Mounting

    • Required Files

    • Image Mounting

    • Steps of Image Mounting

    • Mount Multi-Part Raw Disk Image with FTK
  • 10

    Summary

    • Chapter Summary

4 CPE Credits

After completing this course, you will earn:

Learning Outcomes

This course demonstrates the skills that you need to master the FTK Imager tool.

  • Install FTK Imager on local machine or portable devices

  • Use FTK Imager for evidence acquisition and evidence analysis, including memory and disk imaging

  • Encrypt and decrypt a forensic image

  • Demonstrate different exporting features in FTK Imager

  • Use the hex value interprete

  • Acquire protected files

  • Mount Forensic Images

Technical Requirements

For the hands-on labs in this course

  • Windows 10 operating system (recommended)

  • Internet Connection

  • A USB flash of any size

Course Reviews

What Other People Said About This Course

“Good explanation of how to work with FTK Imager with the different features available.”

Felipe Cru

What is next at Cyber 5W?

Add your email to the mailing list to get the latest updates.