FTK Bootcamp

Level: Beginner.

Duration: 3 days.

The AccessData Bootcamp three-day course provides the knowledge and skills necessary to install, configure, and effectively use Forensic Toolkit (FTK), FTK Imager and Registry Viewer.

Prerequisites

This hands-on class is intended for new users, particularly forensic professionals and law enforcement personnel, who use AccessData forensic software to examine, analyze, and classify digital evidence.

To obtain the maximum benefit from this class, you should meet the following requirements:

Class Materials and Software

You will receive the associated materials prior to the course.

During this three-day, hands-on course, participants will perform the following tasks:

Modules

Module 1: Introduction

Objectives:

Lab:

Participants will install the UTK components—FTK, KFF Library, FTK Imager, and Registry Viewers

Module 2: FTK Imager 101

Objectives:

Lab:

During the practical participants acquire an image of a thumb drive, then explore the FTK Imager features and functions discussed in the module, including converting an image to a different image format, creating a Custom Content Image, and mounting an image.

Module 3: Registry Viewer 101

Objectives:

Lab:

During the practical, participants use Registry Viewer to recover information from a sample image. Participants will then generate registry reports for individual registry files.

Module 4: FTK Administration

Objectives:

Lab:

Students will perform basic system functions such as creating user accounts and defining different levels of permissions to a case, managing shared objects, and customizing the FTK interface. Students will also create custom profiles.

Module 5: Case Creation

Objectives:

Lab:

Students will walk through the process of case creation, including selection of processing profiles/options, adding of evidence and the selection of custom processing data.

Module 6: Overview of FTK Interface

Objectives:

Lab:

Participants will go over the features of all of the tabs within the FTK Examiner Interface

Module 7: Case Analysis

Objectives:

Lab:

During the practical, participants will explore the basic capabilities of FTK to analyze case data. The steps performed here will done using a case workflow format. A case scenario will be provided and participants will find and bookmark “evidence” by using the capabilities of the tool.

Module 8: Case Refinement

Objectives:

Lab:

This practical will continue finding evidence in the previous module case scenario. The skills here will consist of refining the case to find specific data out of larger datasets.

Module 9: Reporting

Objectives:

Lab:

Participants will use the bookmarked data from the previous modules to generate a case report. During the report creation, discussion will be made about the various options that can be selected to get the desired output for the report.

Para más información consulte nuestro calendario de cursos.