HowTo Guide Malware Hunters（指南恶意软件的猎人）.pdf

How-To Guide Image a Hard Disk Using FTK Imager Document Version 1.0 June 24, 2011 Michael G. Spohn mspohn@ Image a Hard Disk Using FTK Imager Introduction This document is a member of the „How-To‟ series of guides provided to interested parties by . In this guide, we walk you through the steps to image a hard disk using Access Data‟s free FTK Imager tool. In our forensic work, we are often asked how non-incident responders (e.g. IT folks) should obtain forensic images of hard drives. This is a common requirement when doing malware containment or when you need to obtain a disk image from a computer in an off-shore or other remote location. It must be noted here – the proper way to acquire a forensic image of a hard drive is to use the proper hardware and software. This includes write-blockers, and forensic acquisition software that has proven reliable by the courts. Plus the only way to get a true image of a hard drive is to do a dead-disk acquisition. Now that the „proper-way‟ lecture is over, let‟s explore a reliable acquisition method that you can use to image a hard disk or disk volume. Requirements You will need two things to acquire a hard disk image:  Access Data‟s FTK Imager . This venerable tool is used by every forensic analyst I have ever met. It is a truly remarkable and versatile piece of software. There are two versions. The standard version comes with an installer package and requires installation on a Windows host. The second version (FTK Imager Lite) is a self-contained file set that you can run from removable media such as a CD/DVD or USB thumb drive .