Device Imaging

[JackLeonard802]

This task will investigate device imaging tools and techniques

[JackLeonard802]

FTK Imager

• [ ] Disk Imaging
• [ ] Evidence Collection
• [ ] File System Analysis
• [ ] File Carving
• [ ] Hash Verification
• [ ] Command-Line Support

Easy to use, but limited capabilities

[JackLeonard802]

X-Ways

• [ ] disk imaging
• [ ] file recovery
• [ ] file analysis
• [ ] data carving
• [ ] metadata extraction
• [ ] registry analysis
• [ ] memory analysis
• [ ] email analysis
• [ ] encrypted files
• [ ] damaged drive
• [ ] reformatted drive
• [ ] overwritted drive

Comprehensive tool, but requires advanced skill