Join Us!

FTK Imager File Lis...
 
Notifications
Clear all

FTK Imager File Listing  

  RSS
4n6art
(@4n6art)
Active Member

Hello All

In FTK Imager, there is a way *during the imaging* to ask FTKI to create a file listing of the files - which it does in CSV format.

I have an e01 that was created by someone else. The original drive is not available. Is there a way to open the e01 in FTK Imager and have that file listing CSV created? I don't want to mount the image and do a temporary image of the mounted drive just to get the CSV listing unless I absolutely have to.

Or… is there another way for me to get a similar file listing of the files within the e01?

Appreciate any help.
-=Art=-

(haven't checked the AD forums…yet… I figured there would be more eyes here ) )

Quote
Posted : 04/12/2013 11:36 am
Adam10541
(@adam10541)
Senior Member

Just to clarify are you seeking a list of the individual E01 files that are created at the time which includes the MD5 hash results?

OR

Are you hoping for a list of the directory structure, ie all the files and folders that would be visible if you mounted the image and browsed it with Windows explorer?

ReplyQuote
Posted : 04/12/2013 12:23 pm
francesco
(@francesco)
Member

Just add the E01 as evidence and you can right-click it to export a file listing.

ReplyQuote
Posted : 04/12/2013 1:54 pm
jhup
 jhup
(@jhup)
Community Legend

I think she is asking for the "Create directory listings of all files in the image after they are created" list.

This option is on the same screen where the image destination is selected.
The CSV file should be at the same location where the image file is placed.

ReplyQuote
Posted : 04/12/2013 6:55 pm
4n6art
(@4n6art)
Active Member

Duh!! wow… how did I miss that. That's what it was… RightClick and choose "Create Directory Listing"

Thank you!

Yes I was looking for that Directory listing. I didn't want the hash values - just a list of files, locations, sizes and dates. Thanks all!

("Picked the wrong day to quit sniffing glue" Lloyd Bridges… Airplane ) )

-=Art=-

Just add the E01 as evidence and you can right-click it to export a file listing.

ReplyQuote
Posted : 04/12/2013 9:58 pm
Share: