FTK Imager
FTK Imager: FTK Imager is an open-source software by AccessData that is used for creating accurate copies of the original evidence without actually making any changes to it. The Image of the original evidence is remaining the same and allows us to copy data at a much faster rate, which can be soon be preserved and can be analyzed further. The FTK imager also provides you with the inbuilt integrity checking function which generates a hash report which helps in matching the hash of the evidence before and after creating the image of the original Evidence. content: Creating a Forensic Image Capturing Memory Analyzing Image dump Mounting Image to Drive Custom Content Image using AD encryption Decrypt AD Encryption Obtain Protected Files Detect EFS Encryption Export Files
