Computer Forensics with Ftk

Book Preface

Welcome to Computer Forensics with FTK. This book has specially been created to provide you with all the information you need to get started with the FTK investigation platform. You will learn the basics of computer forensics and how to use the FTK to conduct digital investigations generating court-accepted evidence.

What this book covers

Chapter 1, Getting Started with Computer Forensics Using FTK, will get you started with the basic installation and configuration of the FTK and how to prepare your environment lab for digital investigations.

Chapter 2, Working with FTK Imager, will teach you how to use the FTK Imager tool to create forensic images of digital devices from volatile data, such as memory.

Chapter 3, Working with Registry View, will give a step-by-step demonstration on how to work with Registry View to access and extract relevant information from Windows Registry, and how this information can be important during the investigation process.

Chapter 4, Working with FTK Forensics, will cover the main computer forensics process, explaining each step in depth. Also, you will learn some important features of the FTK, such as managing users and processing options.

Chapter 5, Processing the Case, will cover how to use the most important features for processing and filtering data during your investigation process. You will learn how to set up the tool to perform data analysis, search information, and bookmark your findings.

Chapter 6, New Features of FTK 5, will give an overview of the main new features that have been developed in the FTK 5, and make you understand how these new features can help you during your investigations.

Chapter 7, Working with PRTK, will teach you how to perform a password recovery from files and systems using the PRTK and DNA products, and how it will help you to solve problems when you find some protected information.