EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

FTK Bootcamp

Course outline

3 days
Discuss this programme →

Duration

3 days

Overview

The AccessData Bootcamp three-day course provides the knowledge and skills necessary to install, configure, and effectively use Forensic Toolkit (FTK), FTK Imager Password Recovery Toolkit (PRTK) and Registry Viewer.

Prerequisites

This hands-on class is intended for new users, particularly forensic professionals and law enforcement personnel, who use AccessData forensic software to examine, analyze, and classify digital evidence.

To obtain the maximum benefit from this class, you should meet the following requirements:

  • Able to understand course curriculum presented in English
  • Perform basic operations on a personal computer
  • Have a basic knowledge of computer forensic investigations and acquisition procedures
  • Be familiar with the Microsoft Windows environment

Class Materials and Software

You will receive the associated materials prior to the course.

During this three-day, hands-on course, participants will perform the following tasks:

  • Install and configure FTK, FTK Imager, PRTK, and Registry Viewer
  • Use FTK Imager to preview evidence, export evidence files, create forensic images and convert existing images
  • Review Registry Viewer functions, including indexing the registry, creating reports and integrating those reports with your FTK case report
  • Create a case in FTK
  • Use FTK to process and analyze documents, metadata, graphics and e-mail
  • Use bookmarks and check marks to efficiently manage and process case data
  • Update and customize the KFF database
  • Create and apply file filters to manage evidence in FTK
  • Use regular expressions to perform live searches
  • Import search lists for indexed searches in FTK
  • Use the FTK Data Carving feature to recover files from unallocated disk space
  • Create and customize reports
  • Use custom dictionaries and dictionary profiles to recover passwords in PRTK
  • Utilize the index in FTK to create custom dictionaries in PRTK

The course includes multiple hands-on labs that allow students to apply what they have learned in the workshop.

Topics:

  • Identify the FTK components
  • List the FTK and PRTK system requirements
  • Describe how to receive upgrades and support for AccessData tools
  • Install required applications and drivers

Lab: Participants will install the UTK components— FTK, KFF Library, FTK Imager, Registry Viewer, and PRTK

Objectives:

  • Describe standard data storage devices
  • Identify some common software and hardware acquisition tools
  • List some common forensic image formats
  • Use FTK Imager to perform the following functions:
  • Preview evidence
  • Export data files
  • Create a hash to benchmark your case evidence
  • Acquire an image of evidence data
  • Convert existing images to other formats
  • Use dockable windows in FTK Imager
  • Navigate evidence items
  • Use the properties and interpreters windows
  • Validate forensic images
  • Create Custom Content Images
  • Mount images
  • Capture active RAM

Lab: During the practical participants acquire an image of a thumb drive, then explore the FTK Imager features and functions discussed in the module, including converting an image to a different image format, creating a Custom Content Image, and mounting an image.

Objectives:

  • Describe which files comprise the Windows Registry
  • Discuss the elements of the Registry Viewer interface
  • Identify the key features of the Registry Viewer
  • Outline the use of FTK with other tools
  • Create a basic report from FTK
  • Seamlessly launch Registry Viewer from an
  • Determine a user’s time zone setting
  • Determine a user’s SID

Lab: During the practical, participants use Registry Viewer to recover information from a sample image. Participants will then generate registry reports for individual registry files.

Objectives:

  • Effectively use the Case Manager
  • Create an administer users
  • Back up, delete, and restore cases
  • Identify the evidence processing options
  • Create a case
  • Identify the basic FTK interface components, including the menu and toolbar options as well as the program tabs
  • Obtain basic analysis data

Lab: During the practical, participants go through the introductory steps of processing a case, including creating a case, adding evidence to the case, and processing case evidence. Students will also perform basic system functions such as creating user accounts and defining different levels of permissions to a case, managing shared objects, and customizing the FTK interface.

Objectives:

  • Change time zone display
  • Create and manage bookmarks
  • View compound files
  • Export files and folders
  • Create custom column settings to manage the information that appears in the FTK file list
  • Use the Copy Special and Export File List Info features
  • Perform additional analysis, such as full text indexing, after evidence has been added to the case
  • Perform automatic and manual data carving functions

Lab: The labs in this module guide participants through more advanced functions in processing case evidence. During the practical, participants will bookmark evidence, view metadata and compound files, examine registry files, recover

deleted files from the Recycle Bin, export case files and folders, create custom column settings, decrypt files, and use the data carving feature to recover evidence items from file slack and unallocated space.

Objectives:

  • Identify the elements of a graphics case
  • Navigate the FTK Graphics tab
  • Export graphics files and hash sets
  • Tag graphics files using the Bookmarks feature
  • Identify the elements of an email case
  • Identify supported email types
  • Navigate the FTK Email tab
  • Sort email
  • Find a word or phrase in an email message or attachment
  • Export email items

Lab: During the practical, participants explore FTK features to view, sort, and export email and graphic artifacts from the case. Students will also create custom columns for graphics and email, export email and graphics files, and create a hash list.

Objectives:

  • Narrow evidence items using the Known File Filter, checked items, and filtered/ignored items
  • Perform an indexed search
  • Import search terms from text files
  • Perform a regular expression search

Lab: During the practical, participants learn how to effectively sort through case evidence to locate items of interest. Students will use the KFF database to ignore or flag known files, perform keyword searches, use dtSearch options to customize a search, and use regular expressions to search case evidence for pattern data such as credit card numbers

or IP addresses.

Objectives:

  • Explain basic concepts of rule-based filtering in FTK
  • Design a basic filter and use it to filter data
  • Manage shared filters
  • Discuss the use of compound filters
  • Explain the difference between global and tab filters
  • Import and export filters

Lab: During the labs, participants create filters to locate specific items of interest. Students will further refine filter results using compound filters. Finally, students will have a change to import and export filters so they can share filters with co-workers and colleagues.

Objectives:

  • Define a report
  • Modify the case information
  • Include a list of bookmarked files
  • Export bookmarked files with the report
  • Include thumbnails of bookmarked graphics
  • Manage the appearance of the Bookmark section
  • Include thumbnails of case graphics
  • Link thumbnails to full-sized graphics in the report directory
  • Export and link video files
  • Export rendered videos and thumbnails
  • Include a list of directories, subdirectories, files, and file types
  • Include a list of case files and file properties in the report
  • Export case files associated with specific file categories
  • Append a registry report to the case report

Generate reports in the following formats:

  • PDF
  • HTML
  • RTF
  • WML
  • XML
  • DOCX
  • ODT

Generate reports in other languages

Lab: During the practical, participants create multiple reports from a single case to explore all options available from the report wizard. They build from a very basic report to a detailed report that contains customized report items.

Objectives:

Navigate within the PRTK interface

Identify the available password recovery modules and their associated attack types

Import user-defined dictionaries and FTK word lists to use in a password recovery attack

Create biographical dictionaries

Set up profiles

Explain what a PRTK profile is and how it is used

Recount the AccessData Methodology

Lab: During the labs, participants will use PRTK to recover passwords from data files. Students will also apply the AccessData Methodology to decrypt files in a sample image. This process will require students to export the FTK case index and Registry Viewer’s registry index to create a custom dictionary, create a biographical dictionary and custom profiles, then re-apply intel gathered from decrypted files to attack other encrypted files.

Programme scope, delivery arrangements and suitability are confirmed during enquiry.