Ftkug Ftk 3 Ug

2012-09-18

• AccessData FTK 3.0
  • Legal Information
    • AccessData Trademarks
  • Documentation Conventions
  • Registration
    • Subscriptions
  • AccessData Contact Information
    • Mailing Address and General Phone Numbers
    • Technical Support
    • Documentation
  • Professional Services
    • Contact Information for Professional Services
• Table of Contents
• Chapter 1 Introduction to AccessData Products
  • Audience
  • Role of AccessData Forensic Investigation Tools
  • AccessData Forensic Products
    • AccessData eDiscovery
    • AccessData Enterprise
    • Forensic Toolkit
    • FTK Imager
    • Lab
    • Language Selector
    • Mobile Phone Examiner
    • Registry Viewer
    • SilentRunner
  • Password Discovery and File Decryption
    • DNA and PRTK
    • Features Overview
    • DNA and PRTK Add-Ons
      • Portable Office Rainbow Tables
      • Rainbow (Hash) Tables
      • TACC Unit
  • License Management
    • CodeMeter Runtime
    • LicenseManager
• Chapter 2 AccessData Forensic Toolkit 3.0 Overview
  • Computer Forensic Investigation Overview
    • Acquiring the Evidence
    • Preserving the Evidence
    • Analyzing the Evidence
      • Indexing and Hashing
      • Searching
    • Bookmarking
    • Presenting Evidence
  • Managing Cases
• Chapter 3 AccessData ForensicToolkit Installation
  • Installation Information
    • Hardware Considerations
    • Estimating Hard Disk Space Requirements
    • Configuration Options
  • Installing FTK
    • Install CodeMeter
    • Install Oracle
  • Single Computer Installation
    • Install FTK
    • Install the Evidence Processing Engine
  • Install the KFF Library
  • Installing on Separate Computers
  • Additional Programs
    • Install Language Selector
      • Using Language Selector
      • Licensing
• Chapter 4 The FTK 3.0 User Interface
  • About Evidence
    • Acquiring and Preserving Static Evidence
    • Acquiring and Preserving Live Evidence
    • Acquiring Remote Evidence
  • Create a Case
  • Open an Existing Case
  • Add Evidence
  • Work The Case
    • Identify Meaningful Evidence
  • Generate Reports
  • Moving Forward
    • Using the CodeMeter Stick
  • Starting FTK
    • Set Up the Application Administrator
  • Basics of The FTK 3.0 User Interface
    • Using the Case Manager Window
    • Case List
      • Create a New Case
  • Case Management
    • Backing Up the Case
    • Archiving a Case
    • Archive and Detach a Case
    • Attach a Case
    • Restore a Case
    • Delete a Case
    • Storing Case Files
  • The FTK User Interface
    • Undocking
    • Toolbar Components
    • File List Pane
    • File List Toolbar
      • File List View Right-Click Menu
      • QuickPicks Filter
      • The Data Processing Status Screen
• Chapter 5 Starting a New FTK 3.0 Case
  • Launch FTK
    • Assigning Roles
  • Creating a Case
    • Selecting Evidence Processing Options
    • Fuzzy Hashing
      • Creating a Fuzzy Hash Library
      • Selecting Fuzzy Hash Options During Initial Processing
      • Additional Analysis Fuzzy Hashing
    • Comparing Files Using Fuzzy Hashing
    • Viewing Fuzzy Hash Results
    • Selecting dtSearch* Text Indexing Options
      • Indexing a Case
      • dtSearch Indexing Space Requirements
      • New Case Indexing Options
      • Selecting Data Carving Options
      • Explicit Material Identification
    • Selecting Evidence Discovery Options
      • Creating the Custom File Identification File
    • Selecting Evidence Refinement (Advanced) Options
      • Refining Evidence by File Status/Type
      • Refining Evidence by File Date/Size
    • Selecting Index Refinement (Advanced) Options
      • Refining an Index by File Status/Type
      • Refining an Index by File Date/Size
    • Creating the Case
    • Adding Evidence to a New Case
    • Processing Evidence
    • Viewing Processed Items
  • The FTK User Interface
• Chapter 6 Adding and Processing Static Evidence
  • Static Evidence vs. Remote Evidence
  • Acquiring and Preserving Static Evidence
  • Opening an Existing Case
  • Adding Evidence
    • Selecting a Language
    • Additional Analysis
    • Hashing
    • Data Carving
      • Data Carving Files When Processing a New Case
      • Data Carving Files in an Existing Case
  • The FTK User Interface
  • FTK Menus and Toolbars
  • Menu Bar Components
    • File Menu Options
    • Edit Menu Options
    • View Menu Options
    • Evidence Menu Options
    • Filter Menu Options
    • Tools Menu Otions
    • Help Menu Options
  • Toolbar Components
    • QuickPicks Filter
    • File List Pane
      • File List Toolbar
  • Using Tabs
• Chapter 7 Adding and Processing Remote Live Evidence
  • Acquiring and Preserving Remote Evidence
    • FTK Role Requirements
    • Acquiring Data Remotely
      • Provide Credentials
  • Remote Disk Management System (RDMS) Additional Information
    • RDMS Requirements for Manual Deployment
      • Utilizing the Agent
• Chapter 8 Using Tabs to Explore & Refine Evidence
  • Using Tabs to Explore and Refine Evidence
    • Explore Tab
      • Viewer Pane
      • Properties Tab
      • Hex Interpreter Tab
    • File Content Tab
      • Hex Tab
      • Text Tab
      • Filtered Tab
      • Natural Tab
    • Overview Tab
      • File Items Container
      • File Extension Container
      • File Category Container
      • File Status Container
      • Bookmark Container
    • Email Tab
      • Email Status Tree
      • Email Tree
    • Graphics Tab
      • Using Thumbnails
      • Moving the Thumbnails Pane
  • The Bookmarks Tab
    • Creating a Bookmark
      • Viewing Bookmark Information
      • Bookmarking Selected Text
      • Adding to an Existing Bookmark
      • Creating Email or Email Attachment Bookmarks
      • Adding Email and Email Attachments to Bookmarks
      • Moving a Bookmark
      • Deleting a Bookmark
      • Deleting Files from a Bookmark
  • Search Tabs
    • Live Search Tab
      • Index Search Tab
    • Volatile Tab
  • Creating Tabs
• Chapter 9 Searching a Case
  • Conducting a Live Search
    • Customizing the Live Search Tab
  • Conducting a Pattern Search
    • Simple Pattern Searches
    • Complex Pattern Searches
    • Predefined Regular Expressions
    • Creating Custom Regular Expressions
    • Conducting Hex Searches
    • Conducting Text Searches
  • Conducting an Index Search
    • Search Terms
    • Search Criteria
    • Index Search Options
  • Documenting Search Results
    • Using Copy Special to Document Search Results
    • Bookmarking Search Results
• Chapter 10 Using Filters
  • The Filter Toolbar
  • Using Filters
    • Predefined Filters
  • Customizing Filters
    • Creating a Filter
    • Refining a Filter
    • Exporting a Filter
    • Deleting a Filter
  • Using the Known File Filter
    • A Closer Look at the AccessData KFF Library
      • KFF Library Sources
    • Importing KFF Hashes
    • Exporting KFF Hashes
      • Understanding How the KFF Database is Used
    • Storing Hashes in the KFF Database
    • Creating Sets and Groups
• Chapter 11 Decrypting EFS and Other Encrypted Files
  • Understanding EFS
  • Decrypting EFS Files and Folders
    • Decrypting Windows EFS Files
      • Understanding EFS
    • Windows 2000 and XP Systems Prior to SP1
    • Windows XP SP1 or Later
  • Viewing the Decrypted Files
    • Decrypting Domain Account EFS Files from Live Evidence
  • Decrypting Credant Files
    • Using an Offline Key Bundle
    • Using an Online Key Bundle
  • Decrypting Safeguard Utimaco Files
    • Decrypting SafeBoot Files
  • Decrypting Guardian Edge Files
  • Decrypting an Image Encrypted With PGP® Whole Disk Encryption (WDE)
    • About PGP® Corporation and PGP® Whole Disk Encryption
    • PGP® WDE Decryption in FTK 3.0
• Chapter 12 Working with Reports
  • Creating a Report
    • Saving Your Settings
    • Entering Case Information
    • Managing Bookmarks in a Report
    • Managing Graphics in a Report
    • Selecting a File Path List
    • Adding a File Properties List
    • Registry Selections
    • Selecting the Report Output Options
    • Customizing the Formatting of Reports
    • Creating the Report
  • Viewing and Distributing a Report
  • Modifying a Report
  • Printing a Report
• Chapter 13 Customizing the FTK Interface
  • Customizing Overview
  • The View Menu
    • The Tab Layout Menu
    • Moving View Panes
    • Creating Custom Tabs
    • Customizing File List Columns
    • Creating and Modifying Column Settings
    • Available Columns
      • Common Features
      • Disk Image Features
      • Email Features
    • Entropy Statistics
    • File Status Features
      • File System Features
      • DOS File Systems
      • ext2 File Systems
      • HFS File Systems
      • NTFS File Systems
      • Unix Security File Systems
      • Mobile Devices
      • Zip-specific Features
      • Temporary File Folder
      • Data Carving
• Appendix A File Systems and Drive Image Formats
  • File Systems
  • Hard Disk Image Formats
  • CD and DVD Image Formats
• Appendix B Recovering Deleted Material
  • FAT 12, 16, and 32
  • NTFS
  • ext2
  • ext3
  • HFS
• Appendix C Program Files
  • Files and Folders for the Application
  • Files and Folders for the Database
  • Changing Registry Options
• Appendix D Gathering Windows Registry Evidence
  • Understanding the Windows Registry
    • Windows 9x Registry Files
    • Windows NT and Windows 2000 Registry Files
    • Windows XP Registry Files
    • Possible Data Types
    • Additional Considerations
      • Seizing Windows Systems
  • Registry Quick Find Chart
    • System Information
    • Networking
    • User Data
    • User Application Data
• Appendix E Managing Security Devices and Licenses
  • NLS Support
  • Installing and Managing Security Devices
    • Installing the Security Device
      • Installing the CodeMeter Runtime Software
      • Installing Keylok Dongle Drivers
  • Installing LicenseManager
  • Managing Licenses with LicenseManager
    • Starting LicenseManager
    • The LicenseManager Interface
      • The Installed Components Tab
      • The Licenses Tab
  • Opening and Saving Dongle Packet Files
  • Adding and Removing Product Licenses
    • Remove a License
    • Add a License
    • Adding and Removing Product Licenses Remotely
      • Add a License Remotely
      • Remove a License Remotely
    • Updating Products
      • Check for Product Updates
      • Download Product Updates
      • Purchase Product Licenses
      • Send a Dongle Packet File to Support
• AccessData Glossary