FTK1UG FTK 1.80 Manual

2012-09-18

• Audience
• Handling Evidence
• Role of Forensic Toolkit
• Other AccessData Products
  • Password Recovery Software
  • FTK 2.0
• FTK Overview
  • The Big Picture
  • Acquiring and Preserving the Evidence
  • Analyzing the Evidence
    • Hashing
    • Known File Filter
    • Searching
  • Presenting the Evidence
• Installing the Forensic Toolkit
  • System Requirements
  • Supported File Systems and Image Formats
  • System Preparation
  • Basic Installation
    • Basic Install from CD
    • Basic Install from Downloadable Files
  • Upgrade Instructions
    • Upgrading from CD
    • Upgrading from Downloadable Files
  • Uninstalling
• Getting Started
  • Starting FTK
    • Using the Start Menu
    • Using the Command Line
    • Using the Case File
    • Using the Dongle
    • Using the FTK Startup Menu
  • Overview Window
    • Evidence and File Items
    • File Status
    • File Category
  • Explore Window
  • Graphics Window
  • E-mail Window
  • Search Window
    • Indexed Search
    • Live Search
  • Bookmark Window
  • Toolbar Components
    • Viewer Toolbar
    • Tree List Toolbar
    • File List Toolbar
  • File List Columns
  • FTK Imager
  • Using LicenseManager
    • Starting LicenseManager
• Starting a New Case
  • Starting a Case
  • Completing the New Case Form
  • Entering Forensic Examiner Information
  • Selecting Case Log Options
  • Selecting Evidence Processes
  • Refining the Case
  • Refining the Index
  • Managing Evidence
    • Adding Evidence
    • Editing Evidence
    • Removing Evidence
    • Refining Evidence
  • Reviewing Case Summary
  • Processing the Evidence
  • Backing Up the Case
    • Storing Your Case Files
    • Recovering Evidence from a System Failure
    • Backing Up Cases Automatically
• Working with Existing Cases
  • Opening an Existing Case
    • Opening an Existing Case from a Different Location
  • Opening a Case in Case Agent Mode (Read-only)
    • Using the Case Agent Mode Manager
  • Adding Evidence
    • Completing the Add Evidence Form
    • Selecting Evidence Processes
    • Managing Evidence
    • Refining the Index
    • Reviewing Evidence Setup
    • Processing the Evidence
  • Viewing File Properties
    • General Info
    • File Source Info
    • File Content Info
    • Case-Specific Info
    • E-mail Info
  • Setting Up Multiple Temporary Files
• Processing Evidence
  • Using Bookmarks
    • Creating a Bookmark
    • Adding Files to a Bookmark
    • Removing a Bookmark
  • Creating Thumbnails
  • Importing KFF Hashes
  • Verifying Image Integrity
  • Using Analysis Tools
  • Using the Case Log
    • Viewing the Case Log
    • Adding Entries to the Case Log
  • Copying Information from FTK
  • Exporting Files
    • About Recursive File Exporting
  • Exporting the Word List
• Searching a Case
  • Conducting a Live Search
  • Conducting an Indexed Search
    • Single-Term Searches
    • Multi-Term Searches
    • Importing Search Terms
    • Viewing Search Results
    • Reloading a Search Query
    • Wildcard Characters
    • Indexed Search Options
  • Documenting Your Search Results
    • Copying Search Results to the Clipboard
    • Using Copy Special to Document Search Results
    • Bookmarking Search Results
• Advanced Searching
  • Searching the Main Viewer
  • Searching the File List Columns
  • Searching for Internet Keywords
    • Viewing Internet Addresses
    • Saving Internet Keyword Search Lists to the Case
    • Bookmarking Internet Keyword Search Items
• Data Carving
  • Searching for Embedded and Deleted Files (Data Carving)
    • Data Carving Files During Evidence Processing in a New Case
    • Data Carving Files in an Existing Case
  • Adding Carved Files to the Case
  • Bookmarking Carved Files
• Using Filters
  • Applying an Existing Filter
  • Using The File Filter Manager
  • Modifying or Creating a Filter
  • Deleting a Filter
• Searching the Registry
  • Starting Registry Viewer
    • Launching Registry Viewer as a Separate Application
    • Launching Registry Viewer from FTK
  • Understanding the Registry Viewer Windows
    • The Full Registry Window
    • The Common Areas Window
    • The Report Window
  • Opening Registry Files
    • Opening a Registry File in Registry Viewer
    • Opening Registry Files within FTK
    • Obtaining Protected Registry Files Using FTK Imager
  • Working with Registry Evidence
    • Adding Keys to the Common Areas Window
    • Deleting Keys from the Common Areas Window
    • Adding Keys to the Report Window
    • Deleting Keys from the Report Window
  • Creating Registry Summary Reports
    • Using Pre-defined AccessData Templates
    • Creating Your Own Registry Report Templates
    • Changing RSR Settings in the FtkSettings.0.ini File
  • Searching for Specific Data
  • Generating a Report
  • Exporting a Word List
• Decrypting EFS
  • Understanding EFS
  • Decrypting EFS Files and Folders
    • Windows 2000 and XP Systems Prior to SP1
    • Windows XP SP1 or Later
  • Viewing the Decrypted Files in FTK
• Working with Reports
  • Creating a Report
    • Entering Basic Case Information
    • Managing Bookmarks
    • Selecting the Properties of Bookmarked Files
    • Managing Thumbnails
    • Selecting a File Path List
    • Selecting a File Properties List
    • Selecting the Properties of the File Properties List
    • Adding Supplementary Files and the Case Log
    • Selecting the Report Location
  • Viewing and Distributing a Report
  • Updating a Report
  • Modifying a Report
    • Modifying a Report in the Same FTK Session
    • Modifying a Report in a Different FTK Session
• Customizing FTK
  • Customizing Fonts and Colors
  • Customizing Columns
    • Modifying the File Listing Database
    • Creating and Modifying Column Settings
    • Deleting Column Settings
  • Changing the Viewer Settings
  • Changing Preferences
    • Date and Time Format Options
    • File Viewing Options
    • Case Log Options
    • Evidence Cache Size
    • Temporary File Folder
    • KFF Database Location
    • Post Processing Backup Location
    • Show Reminder when Exporting or Creating a Report with Filter Active
    • Show Startup Dialog
• Managing Licenses
  • Managing Licenses with LicenseManager
    • Starting LicenseManager
  • LicenseManager Interface
    • The Installed Components Tab
    • The Licenses Tab
  • Opening and Saving Dongle Packet Files
  • Viewing Product Licenses
  • Adding and Removing Product Licenses
  • Managing Product Licenses on Isolated Machines
    • Adding a Product License to an Isolated Machine
    • Removing a Product License from an Isolated Machine
  • Updating Products
    • Checking for Product Updates
    • Downloading Product Updates
  • Purchasing Product Licenses
  • Sending a Dongle Packet File to Support
• Troubleshooting
• FTK Recognized File Types
  • Document File Types
  • Spreadsheet File Types
  • Database File Types
  • Graphic File Types
  • Multimedia File Types
  • E-mail Message Programs
  • Instant Messaging Programs
  • Executable File Types
  • Archive File Types
  • Other Known File Types
• Regular Expression Searching
  • Understanding Regular Expressions
    • Simple Regular Expressions
    • Complex Regular Expressions—Visa and MasterCard Numbers
  • Predefined Regular Expressions
    • Social Security Number
    • U.S. Phone Number
    • IP Address
  • Going Farther with Regular Expressions
    • Locating More Information on Regular Expressions
    • Common Operators
• Recovering Deleted Material
  • FAT 12, 16, and 32
  • NTFS
  • ext2
  • ext3
• Program Files
• Securing Windows Registry Evidence
  • Understanding the Windows Registry
    • Additional Considerations
  • Registry Quick Find Chart
    • System Information
    • Networking
    • User Data
    • User Application Data
• dtSearch Requests
  • Words and Phrases
  • Wildcards (* and ?)
  • Natural Language Searching
  • Synonym Searching
  • Fuzzy Searching
  • Phonic Searching
  • Stemming
  • Variable Term Weighting
  • AND Connector
  • OR Connector
  • W/N Connector
  • NOT and NOT W/N
  • Numeric Range Searching
• Corporate Information
  • Subscriptions
  • Technical Support
  • Product Returns