>> Now that we know that our
>> write blocking software works,
>> we can begin the actual imaging of our device.
We'll close the drive letter G window
and we're going to go back to FTK Imager.
Of course, you can also use EnCase imager.
Either one of these programs
will work just fine for imaging device.
Just for demonstration purposes,
I'll show you how to use the FTK imaging software.
Again, just double-click through
any prompts that you're going to receive.
From our AccessData FTK Imager screen,
we're going to click "File",
and then we're going to create
a disk image of our thumb drive.
It is a physical drive.
We're going to click "Next".
Then it's going to ask us about
the source that we want to image.
Drive letter 0, that is my computer's hard drive.
Drive 1, that is the device we just formatted.
Then Drive 2,
that is our SanDisk U3 Titanium device,
>> two gigabyte USB.
>> We're going to click that.
Then we're going to select "Finish".
From here you can see where it's
going to start imaging from.
We now have to select the image destinations.
We're going to click "Add",
it gives you different types of
file systems that you can create.
The EO1 file system or the raw file system,
smart or AFF file system.
Just for the purposes of this video,
we're going to use the raw DD format
because pretty much every piece of forensic software
out there can at least look at the raw DD format.
From here, we'll click "Next".
Then it's going to ask you evidence item information.
Case number, if you happen to have
an incident number or case number that you have,
you can enter that in here.
For our purposes, we're just going to enter 1234.
But if you have
something specific that you're working on,
you should enter that in that block.
The next item that you're going to
come across is your evidence number.
Depending on what type of
evidence and how much evidence you have,
you may have 1, 2, 3, 4 pieces of evidence
>> and they should be listed in your notes.
>> The evidence item information
should correspond to your notes.
This is the only piece of evidence that we have.
We're going to select one as our evidence number.
Then it's going to ask us for a unique description,
so we can make that description just
exactly like we saw on our notes.
It is the SanDisk U3 Titanium,
two gigabyte, and then the examiner's name,
and then any other type of notes that you want to take.
Then from here, we're going to click "Next".
Then it's going to ask us about
the image destination folder.
We're going to browse
and then we're going to find our forensic thumb drive.
We'll click "Okay".
It's going to give you an image file name.
We can say SanDisk Cruzer,
or we can call it titanium,
>> two gigabytes.
>> Leave the image fragment size at 1500.
We don't need to use a de-encryption,
so just leave that unchecked.
Then from here, click "Finish".
Then down at the very bottom,
you want to verify the images after they are created.
You can leave everything else
unchecked and then check start.
Then from here, you can see
a progress tab of what's going on.
It will show elapsed time and
then it will give you an estimated time left.
Since this is only a two-gigabyte drive,
it should not take that long.
But to spare you the waiting process,
I will pause and we will come back when it is finished.
From here, we can see that
our access data FTK imager finished its process.
The name of the file was
the SanDisk Titanium two point gigabyte file system.
It upended the .001,
is the file name.
It provides the sector size,
and then it computes the MD5 hash.
The computed hash is here,
and then the reported hash is here.
This is our device
that we've ceased and inserted and this is
the information that is contained on
our forensic drive and we can see that it does match.
It also provides SHA-1 and those again match.
Then if there were any bad sectors requested,
it would show them here.
There are in fact no bad sectors.
Then you can see here down at
the bottom the verified result,
the hash computed during acquisition
matches the hash computed during verification,
the image data is unchanged.
Now we have created an exact image of
the SanDisk Cruzer device
>> onto our forensic thumb drive.
>> From this point, we can close out of
the disk image and verify results.
We'll click "Close" and then from here,
if you wanted to see what's on your device,
you could go back and click "File", add evidence item.
It is a physical drive,
or scroll down to our SanDisk Ultra,
where we have the file, and we'll click "Finish".
You can see that now we have data on the device.
We can also navigate back to our forensic thumb drive.
We will refresh this.
You can see that we do
have two file systems on the device.
Started out with SanDisk titanium,
the first file system,
it's 1.46 gigabytes, and then it created
a second file system, 453 megabytes.
Those are images of that device.
Then it gave us a nice text document.
This text document here, again,
shows everything from the output
of the FTK imaging process.
It will have everything here,
and you can take this and you can
copy this and put into your notes.
It does include the start time,
the finish time, the segments that it created,
it has the MD5 hashes.
All of the pertinent information is here
>> that you're going to want in your notes
>> for that acquisition process.
>> This part of the video covered the acquisition of
media from a thumb drive
>> or some type of external device.
>> The process is pretty similar to doing
a drive from a PC or some type of computer system.
However, the process that we left out,
and it's going to be different from
acquisition of some type of
external media source is that a PC,
especially if it's in a power-on state,
is going to have some type of
virtual memory within that PC.