FTK

FTK is by far probably one of the most tools used this year for me. Shucks, I even got the ACE certification for it [which means nothing, but I don't care]. The following is a little walkthrough of FTK.

What is it?
FTK is one of the top forensic toolkits available. I've heard it goes Encase, FTK, then X-Ways, but I have no data to back that up, just here say. The product site is located here, and that can give you more information. But basically this program lets you load in a disk image in various formats, and analysis the contents of that disk. The accepted formats include: AD1, SMART, dd, AFF, and e01.

QuickStart Guide:
Let's say we have two Android images in the .001 format. We can create a new case, filling the info out however we want. On the main screen we select from the Evidence menu "Add/Remove". Clicking on "Add" will show the following:

We want to select acquired images, since we already have the images of the android device. Clicking OK from the Manage Evidence window will pop up a processing window that will show the images being processed into the case. So say we select two images called android1.001, and android2.001. They will appear in the Evidence window as shown:

Now is where the analysis begins.

To view what's on the devices  or the folder structures, we can select the arrows that are next to the image names in the Evidence Items pane. The File List pane on the bottom will appear with a list of all the files that are found on that image.

A lot of the time we're not really going to be digging through the file structure much, so we can switch over to the Overview tab and see a listing of all the different file types that were found on the images. File Category will list the pre defined category that FTK uses and show how many files are in each category. The File Extension will list all the different file extensions found with the files as an expansion from that extension.

Often a user will delete a file and think that it's gone. If those files haven't been over written in the slack space, we can carve them back out. FTK makes this process fairly easy. To cave an image, select Evidence -> Additional Analysis. We can then select the option for Data Carve.

After letting that run, any carved files that were found will appear under the File Status -> Data Carved Files in the Overview tab. On these images we see that there were 903 files carved. Quite a few for a phone. A large number of them appear to be deleted photos.

Because this is a phone, there aren't any emails that we will be able to find, but if there were, we would use the Email tab. The Graphics tab is just what it says it is. It will list all of the graphics found on an image. Generally there are quite a few, since it will show every single icon on the device. Probably the next most used tab is either the Live Search or the Index Search. The index search is significantly faster, since to use it requires the images added to be indexed. That can be done under Evidence -> Additional Analysis then index search.

In the index search, regex is an option and can be extremely powerful.

A lot of your time is now spent on running searches for terms or looking through file extensions for incriminating evidence. Now that you have the basics down, you can do that. Of course, there is a lot more of FTK that is out there, so don't stop poking around and looking into new options.

Personal Remarks:
Just FYI, a license for FTK costs a couple thousand dollars. She's not cheap. With that said, she is great for doing forensics analysis. I've touched Encase a little, but still fall back to FTK just because of it's ease of use.  If you're looking for a free option check out SleuthKit.