Hi,
Sorry, newbie questions again….
i) I have downloaded the FTK imager (free version) and have just made an image file, and put it on a disk. Now, if I want to recreate the file structure/view the files data, how do I do that? Which utility (in FTK imager or otherwise) will let me view the data, given the image?
ii) Also, I want to try to create a dummy user account. i.e if I don't know the dummy user password (hypothetically), will the image file capture data, which I will be able to access (even though I may not know the password for the dummy account)?
thanks for the help!
i) In FTK imager - File Menu> Add Evidence Item > Image File.
ii) Yes (if I've understood the question)
aah…thanks for the prompt reply! That worked..!!
What I meant was, that when I open the image file, I'll be able to see the data of all users, even though in the original Windows system, the user accounts were password protected (I guess what would be the point of forensics, if I couldn't do that! )….just checking though!
aah…thanks for the prompt reply! That worked..!!
What I meant was, that when I open the image file, I'll be able to see the data of all users, even though in the original Windows system, the user accounts were password protected (I guess what would be the point of forensics, if I couldn't do that! )….just checking though!
FTK Imager…I use this all the time.
You can also try the free Basic version of ProDiscover…but it occurs to me that there may be some other questions/issues here, b/c FTK Imager, which you've already successfully used, clearly shows this data.