Other useful options is the conv=sync,noerror to avoid stopping the image creation when founding an unreadable sector.
If you are trying to image 32 bit Windows System, you will need to use FTK Imager Command Line:
Using command line FTK Imager (for 32 bit Windows System)
NOTE: Take a screenshot and put it on the external HDD. This can be found at: Start -> Computer -> Properties.
Using FTK Imager (on 64 bit Windows Systems)
GNU/Linux live distribution that offers a complete forensic environment organized to integrate existing software tools as software modules and to provide a friendly graphical interface. It comes in 2 versions: GUI version, and Command-Line only.ĬAINE ( Computer Aided INvestigative Environment) The Forensic Toolkit Imager ( FTK Imager) is a commercial forensic imaging software package distributed by AccessData. Today I want to propose my own workflow for acquisition of physical disks on Microsoft Windows systems Every forensic analyst, during his experience, perfects his own workflow for the acquisition of forensic images.