Hi,
I am looking for a good forensic tool that has the same capability as ftk imagers, as in, being able to select folders in isolation for imaging as apposed to an entire disk or volume.
Ive tried FTK CLI, which is a great tool, but doesnt allow you to image a folder in isolation as the GUI version does.
Any suggestions would be greatfull.
Macquisition should allow you to do that and much more.
Have you tried using target disk mode through a write blocker?
http//
Then you can use any of your favorite forensics tools to image it (including FTK imager from another computer).
Otherwise, Macquisition.
Also, if you boot the Mac into single user mode, the file system is mounted read-only and you can copy files off to an external drive. Not the greatest, but would work if you document everything very carefully.
Are you working from a Mac or PC?
If you are on a PC and you have FTK imager which does what you want why are you needing another tool?