Acquiring a Forensic Disk Image with FTK Imager and the Wiebetech USB Writeblocker

This tutorial covers the process of imaging a hard drive that has already been removed from a system with FTK Imager and a write blocker. FTK Imager comes in two versions, one that is installed on a pc and one that can be used during incident response from a thumb drive. We will be using the installed version for this tutorial, but both look and function the same. I will cover the following key steps in the process:

Continue reading “Acquiring a Forensic Disk Image with FTK Imager and the Wiebetech USB Writeblocker”