Hi All,
I'm currently using FTK Imager 3.4.0.5 and trying to image a User Profile from a Mounted HDD which is Bitlocker Encrypted. Once mounted and decrypted I have access to the drive and launch FTK imager, selecting the Contents option. The image then starts and fails around 25 mins with the Errors during AD1 Creating message
AD Exception Failed to open directory J\'For each folder'
I've tried writing the image to the C\ and mounted SSD drive with no success and there are no secure folders on the HDD. I can also take a full Logical/Physical of the HDD it'self but do not want to take 500GB of space.
If anyone has any guidance, it would be much appreciated.
Thanks.
Have you tried just imaging it logically instead of the contents? Never had an issue with imaging Bitlocker encrypted drives by doing so with FTK Imager. From there if you are ONLY concerned about the User's specific folder you can just pull it into an AD1 from your image file.
Have you tried just imaging it logically instead of the contents? Never had an issue with imaging Bitlocker encrypted drives by doing so with FTK Imager. From there if you are ONLY concerned about the User's specific folder you can just pull it into an AD1 from your image file.
Morning Randy - Yes i can image the HDD logically with no problems and i may have to take an AD1 for the Users profile. Im just interested in why the image process starts and then fails stating it won't open the directories.
I'm only going to speak in speculation here my friend
When the AD1's are being created, they are typically loading all the files in before it starts the imaging. What could be happening is it hits something that makes the bitlocker reset and clunks out the imaging process since it no longer can read the files. However, I've never tried this so I have no idea if this is the case.
Additional note while the User folder may be the most vital to what you want get NTFS attributes and the Hiberfil.sys and Pagefile's as well. You seriously never know what could be in those that will help you out! You won't get those if you just took C\User\JoeDirt folder.