Ftkug Ftk 221 Ug

2012-09-18

• AccessData Forensic Toolkit 2.2
  • Legal Information
    • AccessData Trademarks
  • Documentation Conventions
  • Registration
  • AccessData Contact Information
    • Mailing Address and General Phone Numbers
    • Technical Support
    • Documentation
• Table of Contents
• Chapter 1 Introduction
  • Introduction to AccessData Forensic Toolkit
  • Audience
  • Handling Evidence
  • Other AccessData Products
  • License Management
    • LicenseManager
    • CodeMeter Runtime
  • AccessData Forensic Products
    • FTK Imager
    • AccessData Language Selector
    • AccessData Forensic Toolkit
    • AccessData Enterprise
    • AccessData eDiscovery
    • Lab
    • SilentRunner
    • Registry Viewer
    • Mobile Phone Examiner
    • Steganography Plug-in
      • What is Steganography?
      • Supported Steganography Programs
  • File Decryption and Password Discovery
    • PRTK and DNA
    • Features Overview
    • PRTK / DNA Add-Ons
      • Portable Office Rainbow Tables
      • Rainbow (Hash) Tables
      • TACC Unit
  • License Management
    • LicenseManager
    • CodeMeter Runtime
• Chapter 2 Installation and Upgrade
  • Installation Options
  • Installation Configuration Options
  • System Overview
  • Estimating hard disk space requirements
  • Installation
    • Install CodeMeter
    • Install Oracle
  • Single Computer Installation
    • Install FTK
  • Install the KFF Library
  • Installing on Separate Computers
    • Installation Results
  • Additional Programs
    • Install Language Selector
      • Using Language Selector
      • Licensing
  • Upgrading to FTK 2.2
• Chapter 3 Concepts
  • Regarding the CodeMeter Stick
  • Basic Workflow
    • Acquiring and Preserving the Evidence
    • Create a Case
    • Add Evidence
    • work the case
      • Identifying Meaningful Evidence Within a Case
    • Generate Reports
  • Moving Forward
    • Starting FTK
    • Setting Up the Application Administrator
    • Using the Case Management Window
      • Creating a New Case
• Chapter 4 Starting a New FTK 2.2 Case
  • Launch FTK 2.2
    • Assigning Roles
      • Application Administrator
      • Case Administrator
      • Case Reviewer
  • Creating a Case
    • Selecting Evidence Processing Options
    • Fuzzy Hashing
      • Creating a Fuzzy Hash Library
      • Selecting Fuzzy Hash Options During Initial Processing
      • Additional Analysis Fuzzy Hashing
    • Comparing Files Using Fuzzy Hashing
    • Viewing Fuzzy Hash Results
    • Selecting dtSearch Text Indexing Options
    • Selecting Data Carving Options
    • Indexing a Case
    • Selecting Evidence Discovery Options
      • Creating the Custom File Identification File
    • Selecting Evidence Refinement (Advanced) Options
      • Refining Evidence by File Status/Type
      • Refining Evidence by File Date/Size
    • Selecting Index Refinement (Advanced) Options
      • Refining an Index by File Status/Type
      • Refining an Index by File Date/Size
    • Creating the Case
    • Adding Evidence to a New Case
    • Processing Evidence
    • The FTK User Interface
    • Viewing Processed Items
  • Backing Up the Case
  • Restoring a Case
  • Deleting a Case
  • Storing Case Files
• Chapter 5 Adding and Processing Evidence
  • Opening an Existing Case
  • Adding Evidence
  • Selecting a Language
  • Additional Analysis
  • Data Carving
    • Data Carving Files When Processing a New Case
    • Data Carving Files in an Existing Case
  • The FTK User Interface
    • Menu Bar
      • File Menu Options
    • Export File List Info
    • Exporting Files
    • Exporting To Image
    • Exporting the Word List
      • Edit Menu Options
        • Copying Information from FTK
      • View Menu Options
      • Evidence Menu Options
      • Filter Menu Options
      • Tools Menu Otions
        • Verifying Drive Image Integrity
      • Help Menu Options
    • Toolbar Components
      • QuickPicks Filter
    • File List Pane
      • File List Toolbar
  • Using Tabs
• Chapter 6 Using Tabs to Explore & Refine Evidence
  • Explore Tab
  • Viewer Pane
    • Properties Tab
    • Hex Interpreter Tab
  • File Content Tab
    • Hex Tab
    • Text Tab
    • Filtered Tab
    • Natural Tab
      • Default Tab
      • Web Tab
  • Overview Tab
    • File Items Container
    • File Extension Container
    • File Category Container
    • File Status Container
    • Bookmark Container
  • Email Tab
    • Email Status Tree
    • Email Tree
  • Graphics Tab
    • Using Thumbnails
    • Moving the Thumbnails Pane
  • The Bookmarks Tab
    • Creating a Bookmark
    • Viewing Bookmark Information
      • Bookmarking Selected Text
    • Adding to an Existing Bookmark
    • Creating Email or Email Attachment Bookmarks
      • Adding Email and Email Attachments to Bookmarks
    • Moving a Bookmark
    • Deleting a Bookmark
    • Deleting Files from a Bookmark
    • Search Tabs
      • Live Search Tab
      • Index Search Tab
    • Creating Tabs
• Chapter 7 Searching a Case
  • Conducting a Live Search
    • Customizing the Live Search Tab
  • Conducting a Pattern Search
    • Simple Pattern Searches
    • Complex Pattern Searches
    • Predefined Regular Expressions
      • Social Security Number
      • U.S. Phone Number
      • IP Address
    • Creating Custom Regular Expressions
    • Conducting Hex Searches
    • Conducting Text Searches
  • Conducting an Index Search
    • Search Terms
    • Search Criteria
      • Index Search Options
  • Documenting Search Results
    • Using Copy Special to Document Search Results
    • Bookmarking Search Results
• Chapter 8 Using Filters
  • The Filter Toolbar
  • Applying an Existing Filter
  • Creating a Filter
    • Refining a Filter
  • Deleting a Filter
  • Using the Known File Filter
    • Understanding KFF Hashes
    • Importing KFF Hashes
    • Exporting KFF Hashes
    • Understanding the KFF Database
    • Storing Hashes in the KFF Database
    • Creating Sets and Groups
• Chapter 9 Decrypting Encrypted Files
  • Decrypting Files and Folders
    • Decrypting Windows EFS Files
      • Understanding EFS
  • Viewing Decrypted Files
  • Decrypting Domain Account EFS Files
  • Decrypting Credant Files
    • Using an Offline Key Bundle
    • Using an Online Key Bundle
  • Decrypting Safeguard Utimaco Files
    • Decrypting SafeBoot Files
• Chapter 10 Working with Reports
  • Creating a Report
    • Saving Settings
    • Entering Basic Case Information
    • Including Bookmarks
      • Selecting Sort Options
      • Setting Bookmark Columns
    • Including Graphics
    • Selecting a File Path List
    • Selecting a File Properties List
    • Registry Selections
  • Running the report
    • Selecting the Report Location
    • Creating the Report
  • Viewing a Report
    • International Date and Time Stamp Issue
  • Modifying a Report
  • Printing a Report
• Chapter 11 Customizing the Interface
  • Customizing Overview
  • Using the View Menu to Customize the FTK Interface
    • Customizing the Tab Views
    • Using the Tab Layout Menu
    • Moving View Panes
    • Creating Custom Tabs
  • Customizing File List Columns
    • Creating and Modifying Column Settings
    • Available Columns
      • Common Features
      • Disk Image Features
      • Email Features
        • Microsoft Outlook Express Headings
        • Microsoft Outlook/Exchange Headings
      • Entropy Statistics
      • File Status Features
      • File System Features
        • DOS File Systems
        • ext2 File Systems
        • HFS File Systems
        • NTFS File Systems
        • Unix Security File Systems
      • Steganography
• Appendix A File Systems and Drive Image Formats
  • File Systems
  • Hard Disk Image Formats
  • CD and DVD Image Formats
• Appendix B Recovering Deleted Material
  • FAT 12, 16, and 32
  • NTFS
  • ext2
  • ext3
  • HFS
• Appendix C Program Files
  • Files and Folders for the Application
  • Files and Folders for the Database
  • Changing Registry Options
    • Changing the Logging Registry Options
      • Chatty Worker
• Appendix D Gathering Windows Registry Evidence
  • Understanding the Windows Registry
    • Windows 9x Registry Files
    • Windows NT and Windows 2000 Registry Files
    • Windows XP Registry Files
    • Possible Data Types
    • Additional Considerations
      • Seizing Windows Systems
  • Registry Quick Find Chart
    • System Information
    • Networking
    • User Data
    • User Application Data
• Appendix E Troubleshooting
  • Finding Answers
  • Troubleshooting Tables
  • Diagnostics Tools
    • Database Diagnostics
  • Uninstalling FTK 2.2 and The Oracle Database
    • Automated Uninstall
• Appendix F Managing Security Devices and Licenses
  • NLS Support
  • Installing and Managing Security Devices
    • Installing the Security Device
      • Installing the CodeMeter Runtime Software
        • Locating the Setup File
        • Running the CodeMeter Runtime Setup
        • The CodeMeter Control Center
      • Installing Keylok Dongle Drivers
        • Windows Found New Hardware Wizard
  • Installing LicenseManager
  • Managing Licenses with LicenseManager
    • Starting LicenseManager
    • The LicenseManager Interface
      • The Installed Components Tab
      • The Licenses Tab
  • Opening and Saving Dongle Packet Files
  • Adding and Removing Product Licenses
    • Remove a License
    • Add a License
    • Adding and Removing Product Licenses Remotely
      • Add a License Remotely
      • Remove a License Remotely
    • Updating Products
      • Check for Product Updates
      • Download Product Updates
      • Purchase Product Licenses
      • Send a Dongle Packet File to Support
• AccessData Glossary