FTKImager UserGuide
FTKImager UserGuide
User Guide
| 1
AccessData Legal and Company
Information
Legal Information
©2019 AccessData Group, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
AccessData Group, Inc. makes no representations or warranties with respect to the contents or use of this
documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any
particular purpose. Further, AccessData Group, Inc. reserves the right to revise this publication and to make
changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.
Further, AccessData Group, Inc. makes no representations or warranties with respect to any software, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, AccessData Group, Inc. reserves the right to make changes to any and all parts of AccessData
software, at any time, without any obligation to notify any person or entity of such changes.
You may not export or re-export this product in violation of any applicable laws or regulations including, without
limitation, U.S. export regulations or the laws of the country in which you reside.
Exterro Inc.
4145 SW Watson Ave.,
Suite 400,
Beaverton,
OR 97005 USA
AccessData Trademarks and Copyright Information
The following are either registered trademarks or trademarks of AccessData Group, Inc. All other trademarks are
the property of their respective owners
.
LawDrop® Summation®
| 2
A trademark symbol (®, ™, etc.) denotes an AccessData Group, Inc. trademark. With few exceptions, and
unless otherwise notated, all third-party product names are spelled and capitalized the same way the owner
spells and capitalizes its product name. Third-party trademarks and copyrights are the property of the trademark
and copyright holders. AccessData claims no responsibility for the function or performance of third-party
products.
| 3
2009 Pixware SARL", with every copy of the Application. This copyright notice may be placed together
with Licensee's own copyright notices, or in any reasonably visible location in the packaging or
documentation of the Application.
Licensee may use, distribute, license and sell the Application without additional fees due to Licensor,
subject to all the conditions of this License Agreement.
"Amazon Web Services", "AWS" "AWS Aurora" "AWS Relational Database Service" are trademarks of
Amazon.com, Inc. or its affiliates in the United States and/or other countries and is used with permission
https://aws.amazon.com/aispl/trademark-guidelines/.
Apache(r), Apache Cassandra and the flame logo is a registered trademark of the Apache Software
Foundation in the United States and/or other countries. No endorsement by the Apache Software
Foundation is implied by the use of these marks.
Company Information
Documentation Conventions
In AccessData documentation, a number of text variations are used to indicate meanings or actions. For
example, a greater-than symbol (>) is used to separate actions within a step. Where an entry must be typed in
using the keyboard, the variable data is set apart using [variable_data] format. Steps that require the user to
click on a button or icon are indicated by Bolded text. This Italic font indicates a label or non-interactive item in
the user interface.
A trademark symbol (®, ™, etc.) denotes an AccessData Group, Inc. trademark. Unless otherwise notated, all
third-party product names are spelled and capitalized the same way the owner spells and capitalizes its product
name. Third-party trademarks and copyrights are the property of the trademark and copyright holders.
AccessData claims no responsibility for the function or performance of third-party products.
Registration
The AccessData product registration is done at AccessData after a purchase is made, and before the product is
shipped. The licenses are bound to either a USB security device, or a Virtual CmStick, according to your
purchase.
Subscriptions
AccessData provides a one-year licensing subscription with all new product purchases. The subscription allows
you to access technical support, and to download and install the latest releases for your licensed products during
the active license period.
Following the initial licensing period, a subscription renewal is required annually for continued support and for
updating your products. You can renew your subscriptions through your AccessData Sales Representative.
Use License Manager to view your current registration information, to check for product updates and to
download the latest product versions, where they are available for download. You can also visit our web site,
| 4
AccessData Contact Information
Your AccessData Sales Representative is your main contact with AccessData. Also, listed below are the general
AccessData telephone number and mailing address, and telephone numbers for contacting individual
departments
Technical Support
Technical support is available on all currently licensed AccessData solutions.
You can contact AccessData Customer and Technical Support in the following ways:
https://support.accessdata.com
E-Mail Support:
| 5
Support Hours: Mon-Fri, 7:00 AM – 6:00 PM (MST), except corporate holidays.
Documentation
Please email AccessData regarding any typos, inaccuracies, or other problems you find with the documentation:
[email protected]
Professional Services
The AccessData Professional Services staff comes with a varied and extensive background in digital
investigations including law enforcement, counter-intelligence, and corporate security. Their collective
experience in working with both government and commercial entities, as well as in providing expert testimony,
enables them to provide a full range of computer forensic and eDiscovery services.
At this time, Professional Services provides support for sales, installation, training, and utilization of Summation,
eDiscovery, FTK, FTK Central, FTK Plus, FTK Pro, Enterprise, and Lab. They can help you resolve any
questions or problems you may have regarding these solutions.
| 6
| 7
Table of Contents
Table of Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Chapter 2 Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Installing FTK Imager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Installing Locally . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Installing To a Portable Device. . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Running FTK Imager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Command Line Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Table of Contents | 8
Obtaining Protected Registry Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
Acquiring Protected Registry Files on a Local Machine . . . . . . . . . . . . . . . 31
Accessing Registry files from a Drive Image . . . . . . . . . . . . . . . . . . . . .31
Using Encrypted Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Detecting EFS Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
AD Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
AFF Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
Table of Contents | 9
Chapter 1 Overview
After you create an image of the data, you can then use AccessData Forensic Toolkit (FTK) to perform a
complete and thorough forensic examination and create a report of your findings.
Imager 3.4.1 and later If you create an AD1 using one of these products, it is created only in
FTK 6.0 and later the new v4 format.
Summation 6.0 and later These products can read either AD1v3 or AD1v4 image files.
eDiscovery 6.0 and later
This version can read either AD1v3 or AD1v4 files but creates only
AD1v3 files.
Imager 3.4.0 Use this version when working with AD1 files for 5.x versions of FTK,
Summation, or eDiscovery
You can use this version to open an AD1v4 file and save it as an AD1v3
file. (See below)
FTK 5.x and earlier These products can read only AD1v3 files.
Summation 5.x and earlier These products can create only AD1v3 files.
eDiscovery 5.x and earlier
Imager 3.3.x and earlier
However, you can open a v4 file in Imager 3.4.0 (only) and save it as a v3 file.
Note: Note: An AD1 image is not really a disk image even though the option you use is Create Disk
Image.
Installing Locally
Install FTK Imager to a local hard drive when you intend to attach evidence hardware to that computer for
previewing and imaging evidence.
2. Under Utilities, look for FTK Imager. Click Download to download the latest released version.
3. Click Save File.
4. Browse to the location where you wish to save the install file, and click Save.
5. When the download is complete, browse to the location where it was saved.
6. Execute the setup file by double-clicking it.
Note: On MS Windows Server 2008R2 running User Account Control (UAC), marking the Launch box
does nothing. You must manually run FTK Imager after installation.
13. Click Finish to complete the installation and close the wizard.
/CreateDirListing
Creates a directory listing file in the folder where FTK Imager.exe is run from.
Sample:
"ftk imager.exe" /CreateDirListing e:\precious.E01
/VerifyImage
Verifies an image when you specify the image path and filename.
Sample:
"FTK Imager.exe" /VerifyImage E:\precious.E01
/EnableDebugLog
Enables logging to the FTKImageDebug.log file created in the folder you run FTK Imager.exe from.
Sample:
"FTK Imager.exe" /EnableDebugLog
This chapter discusses the FTK Imager User Interface and options.
Menu Bar
Use the Menu Bar to access all the features of FTK Imager. The Menu Bar is always visible and accessible.
There are four items on the Menu Bar. They are discussed in detail in this section.
File Menu
The File menu provides access to all the features you can use from the Toolbar.
View Menu
The View menu allows you to customize the appearance of FTK Imager, including showing or hiding panes and
control bars.
Help Menu
The Help menu provides access to the FTK Imager User Guide, and to information about the program version
and so forth.
Toolbar
The Toolbar contains all the tools, functions, or features, that can be accessed from the File menu, except Exit.
The following table provides basic information on each feature.
Button Description
Add Evidence Item
Button Description
Export Logical Image (AD1)
Verify Drive/Image
Capture Memory
Export Files
Show or Hide Panels. Choose to show or hide the Toolbar, Evidence Tree, File
List, Properties, Hex Value Interpreter, and/or Custom Content Sources Panes.
View Panes
There are several basic view panes in FTK Imager. They are described in this section.
Click the plus sign next to a source or folder to expand the view to display its sub folders.
Click the minus sign next to an expanded source or folder to hide its contents.
When you select an object in the Evidence Tree, its contents are displayed in the File List. The properties of the
selected object, such as object type, location on the storage media, and size, are displayed in the Properties
pane. Any data contained in the selected object is displayed in the Viewer pane.
Combination Pane
FTK Imager’s lower-left pane has three tabs: Properties, Hex Value Interpreter, and Custom Content Sources.
Each is described here.
Properties
The Properties tab displays a variety of information about the object currently selected in either the Evidence
Tree or the File List.
Properties include information such as object type, size, location on the storage media, flags, and time stamps.
To convert hexadecimal values, highlight one to eight adjacent bytes of hexadecimal code in the Viewer. A
variety of possible interpretations of the selected code are automatically displayed in the Hex Value Interpreter.
This feature is most useful if you are familiar with the internal code structure of different file types and know
exactly where to look for specific data patterns or time and date information.
You can add, edit, and remove one or all sources, and create the image from here.
For more information, see Creating Custom Content Images (page 43).
Viewer
The Viewer shows the content of the currently selected file, based on the Preview Mode selected: Natural, Text,
or Hex. See Preview Modes (page 23) for more information.
The content can be scrolled through so you can see the entire file content. In addition, with Hex Mode selected,
and the Combo Pane Hex Value Interpreter open, the hex interpretation of text selected in the Viewer pane can
be viewed simultaneously.
Use FTK Imager to preview evidence prior to creating the image file(s). You can then choose to image the entire
evidence object, or choose specific items to add to a Custom Content (AD1) image. This chapter discusses
working with evidence and using FTK Imager to accomplish the creation of forensic images that meet your exact
needs.
Previewing Evidence
Evidence items can be previewed prior to deciding what should be included in an image. Beginning with FTK
Imager 3.0 support is included for VXFS, exFAT, and Ext4 file systems.
W A R N I N G: If the machine running FTK Imager has an active Internet connection and you are using Imager to
preview HTML content from the systems cache, there is a potential risk associated with Microsoft
Security Bulletin MS-09-054. AccessData recommends that, wherever possible, users not have an
active internet connection while Imager is running.
Preview Modes
FTK Imager offers three modes for previewing electronic data: Automatic mode, Text mode, and Hex mode.
These modes are selectable from the Mode menu, or from the Toolbar, as introduced in Chapter 2. Each is
described in more detail here.
Automatic Mode
Automatic mode automatically chooses the best method for previewing a file’s contents, according to the file
type. For example:
Web pages, Web-related graphics (JPEGs and GIFs), and any other media types for which Internet
Explorer plug-ins have been installed are displayed by an embedded version of Internet Explorer in the
Viewer.
Text files are displayed in the Viewer as ASCII or Unicode characters.
File types that cannot be viewed in Internet Explorer are displayed outside of FTK Imager in their native
application provided those applications are installed locally, and the appropriate file associations have
been configured in Windows.
File types that cannot be viewed in Internet Explorer and that do not have a known native viewer are
displayed by default in Hexadecimal Mode in the Viewer.
Hex Mode
Hex mode allows you to view every byte of data in a file as hexadecimal code. You can use the Hex Value
Interpreter to interpret hexadecimal values as decimal integers and possible time and date values.
Note: Preview modes apply only when displaying file data. The data contained in folders or other non-file
objects is always displayed in hexadecimal format.
2. Select the source type you want to preview, then click Next.
3. Select the drive or browse to the source you want to preview, then click Finish.
The evidence item appears in the Evidence Tree.
4. Repeat these steps to add more evidence items.
Image Mounting
New beginning in version 3.0 of FTK Imager, Image Mounting allows forensic images to be mounted as a drive
or physical device, for read-only viewing. This action opens the image as a drive and allows you to browse the
content in Windows and other applications. Supported types are RAW/dd images, E01, S01, AFF, AD1, and L01.
Full disk images RAW/dd, E01, and S01 can be mounted Physically. Partitions contained within full disk images,
as well as Custom Content Images of AD1 and L01 formats can be mounted Logically. The differences are
explained in this section.
Note: AD encrypted images can now be mounted as either a drive or a physical device. Other types of
encrypted images are not supported for mounting as either a drive or physical device.
Note: When Logically mounting an image, the drive or partition size displays incorrectly in the Windows Start >
Computer view. However, when you open the “drive” from there, the folders and files contained within the
mounted image do display correctly.
E01, S01, AFF, and 001 (RAW/dd) images are drive images that have the disk, partition, and file structure as
well as drive data. A physical disk image can be mounted Physically; and its disk image partition(s) can be
mounted Logically.
Mounting an Image
To mount an image
1. If you already have the desired image added as evidence in the Imager Evidence List, select that item,
then do Step 2 to auto-populate the Source box with the image file to be mounted, as shown in Step 3.
If you do not already have the desired image added as evidence, begin with Step 2.
Available Mount Types are Physical & Logical, Physical Only, and Logical Only.
If the Mount Type selected includes Logical, you can select the Drive Letter to assign as the mount
point.
5. Click the Drive Letter drop-down to see all drive letters that are available for assignment to the mounted
image
Available Mount Methods are shown and described in the following table:
To mount another image, repeat the process. You can continue to mount images as needed, until you
run out of evidence to add, or mount points to use. Mounted images remain available until unmounted,
or until Imager is closed.
10. Click Close to return to FTK Imager.
Unmounting an Image
To unmount a mounted image
1. Click File > Image Mounting.
2. In the Mount Image to Drive dialog box, highlight the image to unmount.
3. Click Unmount.
4. Click Done to close the Mount Image to Drive dialog and return to FTK Imager.
Note: You must select the entire evidence item to remove it; you cannot remove only part of an item.
Note: These steps will not acquire Protected Files from a drive image; only from the live system running
Imager. See the directions below to acquire Protected Files from a drive image.
In XP
1. Navigate to [Drive]:\Documents and Settings\[username]\.
2. Export
ntuser.dat
System
Software
Security
In Vista
1. Navigate to [Drive]:\Users\[username]\
2. Export
ntuser.dat
3. Navigate to [Drive]:\Windows\System32\Config\
4. Export the following files:
SAM
System
Software
Security
Regardless of the operating system, export the files to an accessible location (where you have rights and
permissions), then add/open them one at a time in Registry Viewer.
AD Encryption
FTK Imager 3.0 and later has the ability to encrypt data during export to an image. This feature is know as AD
Encryption.
Note: A raw key file is any arbitrary file whose raw data will be treated as key material.
Certificates use public keys for encryption and corresponding private keys for decryption.
To encrypt with a password, mark Password, then type and re-type the password to use.
To encrypt with a certificate, mark Certificate then browse to the certificate to use.
AFF Encryption
New beginning in FTK Imager 3.0 is the ability to create images using AFF Encryption. When you create an AFF
encrypted image, a password is required. If you wish to open that encypted image later, you will need to supply
the password that was used when it was created.
FTK Imager allows you to make several different types of forensic images. In addition, drive content and hash
lists can be exported. This chapter discusses the available options.
Select Source
2. In the Select Source dialog box, select the source you want to make an image of.
Create Image
Compare the stored hashes of your image content by checking the Verify images after they are
created box. If a file doesn’t have a hash, this option will generate one.
List the entire contents of your images with path, creation dates, whether files were deleted, and
other metadata. The list is saved in tab-separated value (.TSV) format.
7. Select the type of image you want to create.
Note: If you are creating an image of a CD or DVD, this step is skipped because all CD/DVD images
are created in the IsoBuster CUE format. Hashes are not generated for CD and DVD images so
they will not be verified, as well.
Note: If the destination folder you select is on a drive that does not have sufficient free space to store
the entire image file, FTK Imager prompts for a new destination folder when all available space
has been used in the first location. However, all related image files must be saved together in the
same folder prior to being added to a case.
12. In the Image Filename field, specify a name for the image file but do not specify a file extension.
13. Specify the Image fragment Size:
Default Image Fragment Size = 1500 MB
To save images segments that can be burned to a CD, specify 650 MB.
To save image segments that can be burned to a DVD, specify 4000 MB.
The .S01 format is limited by design to sizes between 1 MB and 2047 MB (2 GB). Compressed block
pointers are 31-bit numbers (the high bit is a compressed flag), which limits the size of any one
segment to two gigabytes.
13a. Select the compression level to use.
0=No Compression
1=Fastest,Least Compression (faster, and also slightly smaller than a 0-compression file)
9=Slowest, Most Compression (smallest file, slowest to create).
Numbers between 1 and 9 produce an image with varying levels of compression to speed
ratio.
14. To encrypt the image, choose the correct encryption box as explained below:
14a. To encrypt the new image with AD Encryption, mark the Use AD Encryption box.
14b. To encrypt the new image with AFF Encryption, mark the Use AFF Encryption box.
AD Encryption Credentials
If you use a password, you must type, then retype that password to confirm.
Click Show Password to display the password in plain text as you type it the first time, to verify you
are typing it correctly.
Uncheck Show Password to replace the characters with asterisks.
16a. When AFF Encryption is selected, type the password, and retype the password to confirm.
AFF Encryption
16b. Click Show Password to see that you have typed it correctly the first time.
17. When encryption selections are made, click OK to save selections and return to the Create Image
dialog.
Note: The data displayed in the results box vary, according to the type of image created.
Image Summary
The Image Summary also includes the data you entered in the Evidence Item Information dialog.
22. Click OK to close the Image Summary.
23. Click OK to return to the Creating Image dialog.
24. Click Close to exit back to Imager.
Custom Images serve investigators who must acquire evidence quickly, or who need only particular items of
information to create evidence. Images can also be customized to fit on a thumb-drive or other portable media.
Note: When exporting the contents of a folder to a Custom Content Image (AD1), or Logical Image (AD1), if a
file in the folder being exported is locked (in use by another process or program), an error message pops
up showing the problem and the name of the file that is in use.
Note: The Custom Content Sources pane is dockable; that is, you can move it to any corner of the
Imager window, or you can even undock it from the Imager window entirely, and drag it to a
second monitor screen.
3. Continue adding content by repeating this step until you’ve specified or selected all the evidence you
want to add to this Custom Content image.
You can change the items in your custom image list. Use the New and Remove buttons to include or
exclude items, and the Edit button to open the Wild Card Options dialog.
The Wild Card Options dialog box allows you to create filters to find specific files. In the path description
field, you can type:
A question mark ( ? ) to replace any single character in the file name and extension
An asterisk ( * ) to replace any series of characters in a file name and extension
The pipe character ( | ) to separate directories and files
The following table shows examples of wild card filtering:
The check box options can be used individually or in combination to filter unwanted files:
Ignore Case allows all directories in the added evidence regardless of capitalization.
Include Subdirectories includes all files and subdirectories in the added evidence below the
specified folder.
Match All Occurrences locates all directories in the added evidence that match the given
expression. It eliminates the need to right-click each node in the evidence tree and selecting Add to
Custom Content Image (AD1) one by one.
For example, if you wanted to collect all files ending in .doc that reside in all folders named My
Documents, FTK Imager would search all the added evidence for each occurrence of My Documents,
and then collect all .doc files under that directory.
Unchecking Include Subdirectories causes Imager to find only the files in the root of the My
Documents folder.
4. When all Custom Content Sources have been identified and added, click Create Image.
5. In the Create Image dialog box, specify options for this AD1 image.
6. Click Add to add a destination for the new Image.
7. Specify Evidence Item Information.
All evidence item information is optional, but it is helpful to have the information easily accessible in
case it is called into question at any time after creation.
8. Click Next.
16. By default, when the image creation is complete, a status box opens to display a window showing the
files and the hashes (MD5 and SHA1) of your custom image.
16a. Click Close when you are done viewing the hash information.
16b. Click Close again to return to the Creating Image dialog. At this point, the Status window will say
Image Created Successfully.
17. Click Image Summary to open the Image Summary window that displays the Image Creation Log
Evidence Item Information you entered at the beginning.
18. Click OK to return to the Creating Image dialog.
19. Click Close to exit back to Imager.
Exporting Files
Exporting or copying files from an evidence item allows you to print, e-mail, salvage files, or organize files as
needed, without altering the original evidence.
Note: This feature comes in handy if your OS fails, but the drive is still operational. Image your drive and export
your data, photos, etc. from the image.
Exporting By SID
Windows assigns unique identifiers to each process, user, machine, and so forth within its system. A system
identifier (SID) is unique to the system, and most often applies to users.
The Export to Logical Image (AD1) and Add to Custom Content Image (AD1) features now allow the user to
select and export files owned by particular SID(s), or add them to the image.
Create Image.
7. Click Next.
8. Specify Image Destination Folder and Image Filename (without extension)
9. Choose a fragment size for the image.
10. Choose a compression level based on the following information:
0=No Compression
1=Fastest, Least Compression (faster, and also slightly smaller than a 0-compression file)
9=Slowest, Most Compression (smallest file, slowest to create).
Numbers between 1 and 9 produce an image with varying levels of compression to speed ratio.
11. Accept the default Image Fragment Size, or specify the Image Fragment Size to use.
Default Image Fragment Size = 1500 MB
To save images segments that can be burned to a CD, specify 650 MB.
To save image segments that can be burned to a DVD, specify 4000 MB.
0 creates a single-file (non-fragmented) image. Use this if you will never need to use smaller media
for storage or transport of the image data.
12. Mark Use AD Encryption if you wish to apply either passworded encryption or use a certificate for
encryption for the resulting AD1 image file.
13. Mark Filter by File Owner to bring up a list of users found in the evidence that you can select from for
exporting.
14. Click Finish.
Note: User-entered SID(s)/Name(s) persist only as long as this instance of Imager is open.
Note: Click the first, then Shift-click the last to select a block of contiguous files.
Click one, then Ctrl-click individual files to select multiple non-contiguous files.
If a large image is split over multiple drives, it must be verified manually by placing all image
segments in the same directory. For image file(s) that will fit on a DVD, specify a 4GB segment
size.
9. Click Finish to save these settings and exit to the Create Image dialog.
9a. To add another image destination (i.e., a different, additional saved location), click Add and repeat
steps 4-7.
9b. To change an image destination, select the destination to change and click Edit.
9c. To delete an image destination, select the destination and click Remove.
10. Mark the additional options as desired:
Check Verify Images after they are created to check the image hash signature. This detects
whether the content of the original data has changed since it was copied to the image.
Check Create directory listings of all files in the image to record the file names and paths of the
image contents. This record will be saved in Microsoft Excel format, and often functions as evidence.
Check Precalculate Progress Statistics to see approximately how much time and storage space
creating the custom image will require before you start, and as the imaging proceeds.
11. Click Start to begin the export process. A progress dialog appears that shows the following:
The source image file that is being exported
The location where the new image is being saved
The status of the export process
A graphical progress bar
The amount of data in MB that has been copied and the total amount to be copied
Elapsed time since the export process began
Estimated time left until the process is complete
12. By default, when the image creation is complete, a status box opens to display a window showing the
files and the hashes (MD5 and SHA1) of your custom image.
13. Click Close when you are done viewing the hash information.
14. Click Close again to return to the Creating Image dialog. At this point, the Status window will say Image
Created Successfully.
15. Click Image Summary to open the Image Summary window that displays the Image Creation Log
showing the Evidence Item Information you entered at the beginning.
16. Click OK to return to the Creating Image dialog.
For example, if you’re tracking a folder of graphics throughout several drives, you would create a Custom
Content image of those folders and files and export it to a drive. When creating an image of a new device, you
would then import the folders and files from the drive, and Imager will make a Custom Content image of those
folders and files as they occur on the next device you image.
This appendix lists the file systems and image formats that AD Imager recognizes.
File Systems
The following table lists AccessData Imager-identified and analyzed file systems:
Appendix A File Systems and Drive Image Formats Hard Disk Image Formats | 58
CD and DVD Image Formats
The following table lists AccessData Imager-identified and analyzed CD and DVD image formats:
Appendix A File Systems and Drive Image Formats CD and DVD Image Formats | 59
Appendix B Using a Logicube Device
Select Source
2. In the Num of Discs field, type the number of discs loaded into the device.
3. In the Num of Copies field, type the number of copies to be placed on the discs.
4. The Fernico device will image all sub folders by default. Select the No radio button if you don’t want sub
folders imaged.
5. Type a destination for the image in the Image Folder Path field, or use the Browse button.
6. Type a name for the image folder in the Image File Folder Name field.
7. Click Finish. A DOS window will open showing the imaging progress.
For more information on the Fernico FAR System, see the Fernico documentation that came with your Fernico
FAR System.