FTK Imager Lite does not require any files to be installed on the host computer. Several files are required to run off of the USB device in order to launch FTK Imager Lite from the USB device. 7. Test Procedure – Acquire an image of a physical disk without making any changes to the data on the disk Launch FTK Imager Lite on host machine. Connect test device with known files on it to the forensic machine. Hash the original device by clicking “File” and then “Add Evidence Item”. Click “Physical Drive”. “Next”. Select the physical disk that is the known test media. Right click the physical drive represented in the left hand column titled “Evidence Tree”. Select “Verify Drive/Image…”. Maintain screenshot of this MD5 and SHA1 hash as a baseline for the rest of the test procedure. Remove this as an evidence item after the hash is obtained by clicking “File” and then “Remove all Items” or alternatively click the icon in the toolbar for this command. Click “File” and “Create Disk Image”, or alternatively click the gray disk image icon in the toolbar. Select “Physical Drive”. Select the physical disk to be imaged from the drop down menu. “Finish”. In the Create Image dialog box, ensure that the boxes for “verify images after they are created”, “precalculate progress statistics”, and create directory listings of all files in the image after they are created” are checked. Select the type of disk image to be created (e.g., dd, EO1, SMART, etc.). “Next” Enter [Agency Name] unique case number (mandatory), evidence number (mandatory), unique description (optional), examiner (mandatory), notes (optional). Click “Next”. “Browse” and select the destination for the forensic image. This should be placed on an appropriately prepared piece of media. Provide the image file a name according to appropriate naming conventions. Provide a fragment size (if necessary). Select the compression ratio (if applicable). Click “Finish” The image process should begin and will end with a window showing the pre and post MD5 and SHA1 hash values of the network resource.
8. Expected Results The software correctly creates a physical disk of the known device and contains all known files in addition to unallocated space. The software correctly hashes the physical disk and the MD5 and SHA1 hash of the forensic matches the original MD5 and SHA1 hash of the test media. 9. Test Results The actual results were the expected results. 10. Observations / Concerns None. 11. Limitations None. 12. Test Procedure – Acquire a forensic image of logical files without making changes to the files Place a folder on the forensic computer containing known good files. Create a hash of the entire folder using a known good utility. Launch FTK Imager Lite. Click “File”. “Create Disk Image” or alternatively use the toolbar icon. “Contents of a Folder”. Click “Next”. If a warning appears about the compatibility of logical image files, click “Yes” to continue. Select the source of the evidence by clicking “Browse” and then navigate to the good test folder. Click “Ok”. Click “Finish”. In the Create Image dialog box, ensure that the boxes for “verify images after they are created”, “precalculate progress statistics”, and create directory listings of all files in the image after they are created” are checked. Click “Add”. Enter [Agency Name] unique case number (mandatory), evidence number (mandatory), unique description (optional), examiner (mandatory), notes (optional). “Next”.
Compare information from report with good information by running regedit or another known good utility. Launch the “rr” application file. Select the “System” registry hive. Select the report file and save it as SYSTEM Report.txt. Select the “system-all” plugin. Click “Rip It”. Navigate to the “SYSTEM Report.txt” report file and review the contents. Compare report with known good information. Launch the “rr” application file. Select the “Software” registry hive. Select the report file and save it as SOFTWARE Report.txt. Select the “software-all” plugin. Click “Rip It”. Navigate to the “SOFTWARE Report.txt” report file and review the contents. Compare report with known good information. Launch the “rr” application file. Select the “NTUSER.dat” registry hive for a user with known activity. Select the report file and save it as NTUSER Report.txt. Select the “ntuser-all” plugin. Click “Rip It”. Navigate to the “NTUSER Report.txt” report file and review the contents. Compare report with known good information. 9. Test Results The actual results were the expected results. 10. Observations / Concerns None. 11. Limitations None. 12. Recommendations This software should be part of the [Agency Name]’s CIRT forensic tool set.