FTK is apart of the AccessData suite of tools for forensics analysis. FTK is generally one of the top go to tools for forensic experts. The nice thing about FTK Imager is the ease in it's ability to capture a full memory dump. A download can be found here: http://www.accessdata.com/support/product-downloads. The tool can be placed either on a forensics tool cd, or a USB stick. If needed, you can install the program directly onto the machine, but that leaves a LARGE imprint on the machine. To capture the memory, either clicking on the picture of a ram stick on the tool bar, or going through File > Capture Memory, will begin to grab all the memory on a victim machine. This image file can then be analyzed with FTK itself, or through Strings, or another program of choice.
Personal Remarks: The only problem with FTK imager is the footprint it can leave on a victim machine. It will appear as you're capturing data, and could possibly interfere with other processes running. Though, it is an easy way to do things. Compared to DD, all you need to do is point and click and BAM you got a full memory dump. It's also fairly stable so it's highly unlikely it will fail on you while captureing data.
No comments:
Post a Comment