FTK Lite Imaging of a physical drive Using FTK Imager lite, it was determined a live image of the physical system disk resulted in an image with an encrypted bitlocker container on it Note that the phrase "physical" here corresponds directly with FTK Imagers use of the term in their image acquire menu Imaging of a logical partition FTK Imager Lite is a standalone executable which can be run using, for example, a USB This is preferred, as unnecessary installations on the targeted system will further contaminate the evidence An important aspect is to also dump out the volatile data to an external device with enough storage Open Windows Explorer and navigate to the FTK Imager Lite folder within the external HDD Run FTK Imagerexe as an administrator (right click > Run as administrator)
Forensic Disk Images Of A Windows System My Own Workflow Andrea Fortuna
