Creating a case in FTK

Creating a case in FTK

To start with you will need the following:

1. A working licensed FTK
2. An image file (the one used is taken from FTK imager)

Before doing anything, make sure you are NOT connected to the internet

To start with, open up FTK:

this is the logo for FTK

You will then be prompted to sign in with your username and password:

Take your time on this as if its incorrect you will have to go through a long procedure!

Once this is done you will want to click on the case tab and then "New".

This will then bring you to the following screen:

You should fill the information out professionally (do not refer to files with terms of no relevance) as this is good practice. Once done it should look like below:

You will then be taken to the following screen:

Clicking on add will take you to another screen where you have the option of adding an image- for this tutorial we will use the option acquired image, assuming you already have one.

Note: if you do not have one please see the FTK imager tutorial and make one.

You will be asked to find the image at a logical level in order for FTK to add it as an image.

Once this is done you should see the following ( I have filled out the information).

Once Done- your case should look like this next time you boot up FTK. We can now begin exploration.