Download as DOCX, PDF, TXT or read online from Scribd
Download as docx, pdf, or txt
You are on page 1/ 10
Assignment No 2
Name Tayyab Rafique
Enrollment: 01-245191-010 Class MSTN Course Computer &Network Forensic Submitted to Sir Waseem Iqbal Forensic Toolkit Imager (FTK) Report
There are different steps involved in recovering certain file from computer using forensic toolkit imager
Here we discuss how to recover a file using forensic toolkit imager in a step by step process. 1- First after installing Ftk go to the top left corner and click on file. A drop down menu will appear. Select “Add evidence item “from it. After clicking on it a pane will appear asking to select source.in source select logical drive and then select from available drives on PC. The screenshots are attached here 2- After clicking on finish button then the imager asks you where you want to create image. From there select add and give any case number and proceed. then you asked that where you want to create image folder. Then click on browse and select desktop and give the file any random name and click on start. 3- When you click on start it will start creating forensic image.it will also give you the time taken to create image. And if you click n the image summary it will give you entire image summary i.e. where is the image source and what is the time of image formation etc. 4- After creating image go back to “Add Evidence items” and in source select image file and then enter the name of image you created on desktop or browse it. 5- After that on top left corner under the evidence tree your image file will be found with all its information
