Ftkug Ftk2 Manual

2012-09-18

: Pdf Ftk2 Manual ftk2_manual

Open the PDF directly: View PDF .
Page Count: 320 [warning: Documents this large are best viewed by clicking the View PDF Link!]

Scroll down to view the document on your mobile browser.

AccessData Forensic Toolkit
- Legal Information
  - AccessData Trademarks
  - Documentation Conventions
Contents
Chapter 1 Welcome and Overview
- Audience
- Handling Evidence
  - What is a Case?
- Role of Forensic Toolkit
- Other AccessData Products
- Product Overview
- Managing a Case
- Defining the Evidence
- Presenting Evidence
Chapter 2 Installation and Upgrade
- Installation Options
- System Overview
- Estimating hard disk space requirements
- Installation
  - CodeMeter Stick Installation
  - Oracle Installation
- Single Computer Installation
  - Installing the FTK Program
  - Choosing an Evidence Server
- Installing the KFF
- Installing on Separate Computers
- Additional Programs
- Upgrading to FTK 2.1
- Upgrading a Two-Computer Configuration
Chapter 3 Concepts
- Starting FTK
- The FTK Window
- Using Tabs to Explore and Refine Evidence
Chapter 4 Starting a New FTK2.1 Case
- Launch FTK2.1
- Acquiring and Preserving the Evidence
- Creating a Case
- Backing Up the Case
- Restoring a Case
- Deleting a Case
- Storing Case Files
Chapter 5 Working with Cases
- Opening an Existing Case
- Adding Evidence
- Selecting a Language
- Additional Analysis
- File Content, Properties, and Hex Interpreter Tabs
  - Properties Tab
  - The Hex Interpreter Tab
- Using the Bookmark Information Pane
- Verifying Drive Image Integrity
- Copying Information from FTK
- Fuzzy Hashing
Chapter 6 Searching a Case
- Conducting a Live Search
  - Customizing the Live Search Tab
- Conducting a Pattern Search
- Conducting an Index Search
  - Search Terms
  - Search Criteria
- Documenting Search Results
  - Using Copy Special to Document Search Results
  - Bookmarking Search Results
Chapter 7 Data Carving
- Searching for Embedded and Deleted Files (Data Carving)
  - Data Carving Files When Processing a New Case
  - Data Carving Files in an Existing Case
Chapter 8 Using Filters
- The Filter Toolbar
- Applying an Existing Filter
- Creating a Filter
  - Refining a Filter
- Deleting a Filter
- Using the Known File Filter
Chapter 9 Decrypting Encrypted Files
- Decrypting Files and Folders
  - Decrypting Windows EFS Files
- Viewing Decrypted Files
- Decrypting Domain Account EFS Files
- Decrypting Credant Files
  - Using an Offline Key Bundle
  - Using an Online Key Bundle
- Decrypting Safeguard Utimaco Files
  - Decrypting SafeBoot Files
Chapter 10 Working with Reports
- Creating a Report
- Running the report
  - Selecting the Report Location
  - Creating the Report
- Viewing a Report
  - International Date and Time Stamp Issue
- Modifying a Report
- Printing a Report
Chapter 11 Customizing the Interface
- Customizing Overview
- Using the View Menu to Customize the FTK Interface
- Customizing File List Columns
  - Creating and Modifying Column Settings
  - Available Columns
Chapter 12 Other AccessData Applications
- Accessing Additional Products
- Capturing Evidence with Imager
- Recovering Passwords with PRTK
  - How PRTK Works
  - PRTK Features
- Obtaining Protected Information with Registry Viewer
- Managing Licenses with LicenseManager
- Selecting the Application Language
Appendix A Recognized File Types
- Document File Types
- Spreadsheet File Types
- Database File Types
- Graphic File Types
- Email Message Programs
- Instant Messaging Programs
- Executable File Types
- Archive File Types
- Other Known File Types
Appendix B File Systems and Drive Image Formats
- File Systems
- Hard Disk Image Formats
- CD and DVD Image Formats
Appendix C Recovering Deleted Material
- FAT 12, 16, and 32
- NTFS
- ext2
- ext3
- HFS
Appendix D Program Files
- Files and Folders for the Application
- Files and Folders for the Database
- Changing Registry Options
  - Changing the Logging Registry Options
Appendix E Securing Windows Registry Evidence
- Understanding the Windows Registry
- Registry Quick Find Chart
Appendix F Troubleshooting
- Finding Answers
- Troubleshooting Tables
- Diagnostics Tools
  - Database Diagnostics
- Uninstalling Manually
- Other Issues
  - dtSearch Noise File List
Appendix G Corporate Information
- Contacting AccessData Corporation by Mail
- Registration
- Technical Support
- Documentation
FTK Glossary

Navigation menu