FTK

Greetings,

Many of us use FTK Imager. We also use EnCase, SMART, Helix, Raptor, and a host of other imaging tools. No one tool excels in all circumstances and so having multiple options available is a good idea.

I've not used FTK Imager in awhile, but one of the things I did like about it is that you could write out two destinations at the same time. EnCase will only do one.

-David

I find it better, if you were to compare it to EnCase (Acquisition mode) because obviously you can browse the file structure of the device.

Also useful for converting E01's to DD and quickly and easily grabbing registry hives. I like the method for creating custom content images too (the only downside is you cant then easily work with these in EnCase).

But as kovar says there is not one tool that excels.

I prefer to image from Linux but I also keep FTK in my toolbox

Thanks very much people.

I will have a look at all the above programs! I no that my course teachers encase towards the end of the year!

So hopefully i can give myself a head start.

Thanking you

I know LOTS of people who use FTK imager, i think partly due to the EnCase imaging problem in 4.19 and below (although is supposedly fixed in current versions). Only things i dont like about FTKI is one of the boxes i think is slightly badly named when imaging (cant remember if its unique name or which off the top of my head - but doesnt seem to exactly correspond to the relevant field in an EnCase report), and the fact the read errors field isnt populated, only the associated text file (so looking at the report in EnCase could show you 0 read errors, when there were errors).
Rich

Thanks

i am glad of the reponse on FTK because i thought maybe people industry were not using it and i have spent a year learning it!

i have never use EnCase think i mite have to give it a blast.

Thanks very much