Does any one know how to copy only the logical active files from a case using FTK version 1.71? I have a dd image of a 100gb drive. I processed the drive using the default settings in ftk. I need to copy only of the logical active files to a seperate drive.
It should be easy with the correct filter. From the volume root in the Explore tab, select files only in the file list window, instead of all objects. Check the box to list all descendents. Then use a filter to show everything except deleted items. You may need to tweak the filter, as you may want to exclude certain email objects and the like that may otherwise be included. Then export whatever you want. It's apt to be a lengthy process, which you may want to accomplish in limited segments.