Every forensic analyst, during his experience, perfects his own workflow for the acquisition of forensic images. Today I want to propose my own workflow for acquisition of physical disks on Microsoft Windows systems Required tools FTK Imager The Forensic Toolkit Imager (FTK Imager) is a commercial forensic imaging software package …
Article Link: https://andreafortuna.org/dfir/forensic-disk-images-of-a-windows-system-my-own-workflow/