


Copy the entire "FTK Imager" installation folder (default installation folder is in C:\Program Files\AccessData\FTK Imager or C:\Program Files (x86)\AccessData\FTK Imager) to the usb device.After the installation of the tool is complete, connect the flash drive we want to use into the system.

On a machine other than the system we want to image, we need to install FTK Imager.Once we have all the devices we need, we can follow the set-up procedure: Setting up your FTK Imager flash driveįirst of all we need a flash drive on which we can set up the FTK Imager tool and a Windows machine where we can initially install the imagining tool. The FTK Imager tool is easy to use and more importantly, there is a free version. There are different tools available to do this, but the one I most often use is FTK Imager by AccessData. In the process of analyzing a suspicious machine, the first thing we need to do is to actually image the machine we want to investigate.
