fth-7010 manual

Original!! NOT A PHOTOCOPY!! We pride ourselves on welcoming Radio Hobby enthusiasts of all types, while offering unbiased, informative, and friendly discussion among the members. We are working every day to make sure our community is the best Radio Hobbyist's site.Care to buy us a beer. We'd really appreciate it! In this page you find schematic, users and instructions manuals, service manuals, technical supplement, leaf leads and other good stuff. If you have some stuff that not is listed here you can donate this by contact mods.dk. And when you click on the file or icon it will count as a download. If you want to see manuals from other manufactories you can click on the manufactory menu in the left side. You can also click here to see all the manufactories that mods.dk have manuals, schematics or other files from. You should upgrade or use an alternative browser. However, all the info seems to be for the newer Yaesu units. I wonder whether the ADMS software for the newer Yaesu transceivers will work with the fth7010. The programming cable for the newer units have a 4-conductor jack, but the fth7010 seems to have a 3-conductor microphone socket and a 2-conductor speaker socket only. Please help. Thanks.I would check with Yaesu support for this specific HT (if not listed in manual) and check with RT Systems for ADMS software availability.The jack for the fth7010 is the mic jack, 3 conductor. The tip of the conductor is the DATA, and 2nd ring (next to the tip) is the ground. The program is CE2, which is usable for fth-x008, fth-x009, AND fth-x010. The program only runs on DOS, not windows. I used DOS6.2 (apparently works on MSDOS 5.0 up to MSDOS 6.22). It also runs only on a very old and slow computer I borrowed. (apparently works on PCs with 100 Mhz CPU speed). Info here is for interest only. I'm not responsible for any damage to your equipment based on my info. AlexRegister for a free QRZ account.

• yaesu fth 7010 manual, fth-7010 manual, ft 7100 manual.

Search results for: (found: ) ask for a document File Date Descr Size Popular Mfg Model: Found in chassis2model: Found in repair tips. It covers the servicing, maintenance and repair of the product. Exploded views allow to identify all the part numbers and associated parts with the product in case they need to be replaced. This manual includes a description of the functions and capabilities and presents instructions as step-by-step procedures. Schematics and illustrated parts list can also be included. Recent search for yaesu fth 7010. Please do not offer the downloaded file for sell only use it for personal usage. Looking for other manual? For this no need registration. May be help you to repair. You could suffer a fatal electrical shock. Instead, contact your nearest service center. Note! To open downloaded files you need acrobat reader or similar pdf reader program. In addition, Also some files are djvu so you need djvu viewer to open them. These free programs can be found on this page: needed progs If you use opera you have to disable opera turbo function to download file. If you cannot download this file, try it with CHROME or FIREFOX browser. Translate this page: Relevant OTHER forum topics: Yaesu FTL7002 UHF ado-vevo Sziasztok! Tudna valaki segiteni Yaesu FTL-7002 tip. URH ado-vevo mukodesi tartomanyanak a boviteseban. Nem talalok anyagot hozza.Most 450-490Mhz kozott mukodik, de nekem 430-450Mhz-ig kellene. Ha tud valaki segiteni megkoszonom. Udv:pandora yaesu FYG-3u hasznalata sziasztok.CsabaYou can write in English language into the forum (not only in Hungarian). It may not display this or other websites correctly. You should upgrade or use an alternative browser. Simply follow this Shop on Amazon link first and a portion of any purchase is sent to WorldwideDX to help with site costs. If anyone wants to change their username contact an admin and it will be done. Multiple accounts belonging to the same member will be deleted without warning.NEVER USED!!

Positive and fully automatic PTT control is supplied from the computer to the radio from USB port through the circuit based on the Prolific PL-2303TA USB to Serial Bridge Controller and the optocoupler for proper optical isolation between your computer and the radio. A physical Serial Port connection is not needed since the Prolific drivers emulate a virtual Serial (COM) Port which communicates with a radio at the required TTL voltage levels.There is a lot of data mode programs can be found on the Internet. Learn more at privacy policy. Application: Rewire is used to connect cable between walkie-talkie and PC, and then program setting and frequency of walkie-talkie through PC. Specification. Weight: about 30 g. Plug diameter: 3.5 mm. Applicable models (including but not limited to)Please allow 1-3mm differs due to manual measurement. Due to the different display and different light, the picture may not show the actual color of the item. Thanks for your understanding. Included: 1 X 3.5mm USB Programming CableYou have 2 weeks to request refund — up to 84 days. Product doesn't match the description. Contact us within 30 days after you receive it. In case of cancellation, money will be refunded to your account within 14 days. On the B2 version you will seeSee MICROPROCESSOR RESET on Page 85 of the Operations manual. Tone Call andNote that page can take a while to load, if there are many modifications. Remove this product from my favorite's list. Add this product to my list of favorites. You must select at least 1 quantity for this product. More info Comments Main Features Battery Type: Ni-MH Voltage: 7.2 0V Capacity: 1100mAh Color: Black Product Type: Replacement Battery (Brand New) Condition: New, 1 year warranty. Weight: 252.62 g Compatible Part Numbers: FNB-12, FNB-12H Yaesu FT23R FT33R FT73R FT204 FT411 FT411E FT411R FT470 FT470R FT728 FT811 FT811R FT911 FTC7005 FTH2005 Available in Reset Comunicacions, S.L.! Be the first to write your review.

English language (FT-1000) QSK with FT-990 and FT-1000 English language (FT-1000) Yaesu 1000 MP Mark V mod. English language (FT-290) How to prevent the touch-tone pad from automatically keying up your rig English language (FT-290) Some small mods for FT-290 MK I English language (FT-290) FT-290R Mk1 - mod for 1kc and 100hz steps on FM for satellite working English language (FT-290) Common faults found on the FT-290R English language (FT-3000) Yaesu FT-3000 TX mod from 144 to 148 to 140 to 174 MHz. English language (VX-5R) Expanded range for VX5R.Ubicazioni e frequenze Code licensed under MIT License. Programming Cable Simply hook it up to your computer. This programming kit is not a straight forward cable, there is an internal converter circuit board mounted in a DB9 plug. This programming cable provides quick and easy programming of the following Yaesu handheld transceivers: FT-11R, FT-41, FT-51R, FTH-2008, FTH-2009, FTH-2010, FTH-7008, FTH-7009, FTH-7010, VR-120D, VR-120, VR-500. This cable is extensively tested at time of manufacture to be free of defects. This cable does not include any manuals or instructions for use. Therefore, it will be assumed that the purchaser is knowledgeable in using the cable for the applications it is designed for. Please note that we supply the hardware only, we can not supply software. In effect, it enables you to connect your radio directly to your PC and operate a selection of data modes. No external power supply is required. Components are of the highest quality and the unit underwent the stringent quality control and inspection standards. Simply download and install the drivers and software for the modes that you want to try, plug in this cable, and you are set. Please not that this cable does not provide CAT control.

After programming In this case a DOS programmingAlso the data exchange Modern high speed computers vere used For example SENAO SN-258 is attached by its test Vbat - cont. 5. R1 resistor may be omitted because the phone RxD circuit has There are no hardware flow control circuits in the connector. The Siemens Use it for AT-commands with the switch turned The Siemens phone socket pinout is from In order to print it save the GIF image to disk. Then open the GIF file with Adobe Photoshop (or anySome words are in Russian,The recommended value of Rind is Let's see the troubleshooting technique if the cable does not work.. Check the component correspondence Here are the most common errors in the Obviously it will not work. In this case the work is not guaranteed. Those regulator ICs should be used with the external power supply only with They think it will do. No, it will not. Power rectifier diodes and germanium diodes will not work. That is wrong. If the LP2950 is used C4 should be 1.0. 4.7 uF. Broken wires are the frequent reason of malfunction. Please note ! Round stereo jacks must be Their flanges may be ground off if needed. RJ-11 and RJ-45 connectors get oxidized easily. Socket contacts may be cleaned Jack contacts may be cleaned with a thick needle. The wrong voltage may occur due to assembling defects or bad serial port Some software (especially made by Motorola) gives The most common mistake is running DOS programs under Windows. Port accessing Use MS DOS or Windows'98 in DOS mode for such programs.A mobile radio must be powered with an appropriate power supply. Some radios need Some radios Refer to radio manuals Yevgueny RA9MHL, Valery UA6LPG, Alexander 'Gulliver', Vladimir Vashchenko. Sergey Bunin, Pavel RA0SJB, MALE aka Dmitry, Alexander Nesterov. Nikolay aka 'KOKA', Belu Daniel, Norman Miller, Roman RN3ADR, Roman RV3SBQ. Ramil Yunusov, Albina Luchaninova, Oleg EX8MLT, Alexander Ivanov. Alexander UA9CEE, Yuri US5IVZ, Valery UA9MRQ, Victoria Chernigovskaya.

The main goal of this cable Another goal is the correct voltage level VT2 may be BC857 or similar (i.e. BC557B, etc.). Fast silicon diodes of any type will do, for example 1N4148 or LL4148 in. MiniMELF case. LP2950 is replaceable with LM2951 with appropriate resistors, It may fail to work in some cases. Use 78L05 with an external power source. Multiwire cable with Otherwise TxD to RxD interference will result in programming failure. It is DB9 is recommended as a highly reliable one.PTT and C button while powering the radio on.TK-250 enters programming mode by pressing Lamp and In MOTOROLA P040-P080 This connector does not need an external power supply if it is provided from The power supply The corresponding programming cable connector was designed and tested by To be firmly inserted in the Jacks before and after the modification Computers with i80486 are recommended by. VERTEX, iCeleron 433 MHz processor may be also applicable. The common The main idea is the additional level invertion using a CMOS logic IC. CD4093 is recommended because it has Schmitt trigger inputs. However, any. CMOS invertor can be used. Unused IC inputs (not outputs !) should be grounded.MAXON SL500 radios. The programmer is used as a non-inverting buffer. In SL500 connector VD1 and VD2 diodes provide an extra protection of the radio. They can be omitted if desired.It is different The connector is similar to GX-2000 radios. The radio should be programmed with slow computers (recommendedProgrammer schematics is classic. The radio is put into programming mode by Now it is capable to program T3000 series handheld radios. VX-800, VX-4000, VX-6000, etc. These radios have a specific accessory MILITARY portable LPD radio. SIMOCO SRM-9000 series radios. Before programming the radio must be turned on. To do so push and hold SW1 button until HL1 LED switches on.

Press OK button to view Settings menu.Press OK button to view Settings menu. Use “ ” or “ ” button to highlight Timers and press OK to continue: Setting Sleep Timer This setting is used for setting the TV to turn off after. You should then switch on the TV to soft cloth. The following table is an illustration of some of the Source Supported Signals Available typical video display modes. Index Resolution Frequency 640x400 70Hz 60Hz 640x480 640x480 72Hz 75Hz 640x480 800x600 56Hz 800x600 60Hz 800x600. USB-n nagyobb a kimeno teljesitmeny mint 4W altalaban Stalker IX es Grant radiok az elterjedtek mindegyik tilto listas persze nagyon sok tipus van,ha a kamionosokat szeretned hallani csak USB radion fogod bar sokan alnak at az URH ra hivatalosan. Csak olyan radiot vasarolj amit ki tudsz probalni,nem art ha viszel magaddal valakit aki ert hozza. Radiozasal kapcsolatos elvarasok torvenyek atolvasasat javaslom.Tehat akkor USB es URH radiokban kell gondolkodnom.Egyebkent az unioban sehol sem legalis, az USB, nekunk is azert kellett leallitini, mert beleptunk. Pl. Nemetorszagban, Ausztriaban sulyos penzbuntetes es elkobzas van. Vagy ez nem a rendor hataskore.Ilyen radiohoz kellene Nekem akkor kapcsolasi rajzot keritenem.Meg kell majs antenna, az sem a kamionokra valo, nekem Penetrator van. Szoktam neha beszelni rajt. Azok a 3-5000-resek, biztos, hogy tudjak az USB-t? Vagy nem rosszak? Kimeno teljesitmeny 100W a 100W kimenonel felvesz 20A nem kicsi tap kell hozza, LSB,USB,CW,AM,FM savokat tud. Es meg sok jo tulajdonsaga van. Nem biztos hogy erdemes radiot epiteni de az ido meg az alkatresz arak miatt olcsobb ha vasarolsz. Ha valamire szukseged van irj privatra es beszelunk! Stalkert vagy Grantot keress a neten es egy jo allapotu magnestalpas antennat hozza. Ekkor meguszod a kasztnifurast es megoldodik a traffipaxos hirhalozatod. Egy olcso Ceptes valamit meg ha van ismerosod akkor kolcsonkered tole es azt viszed be ha az NHH-sok berendelnenek egy Milyen radio is volt a kocsiban.

En is utaztam mar kamonosokkal es szemtanuja is voltam ket stalker szetfurasanak. Egy valodi stalker azert ennel tobbet erdemel. Kerdeseidre szivesen valaszolok. Nem ertek a radiokhoz, so bocsi a hulye kerdesekert. Eloszor is az erdekelne, hogy ez legalis-e (marmint a hasznalata ). Masik kerdes, valakinek esetleg van hozza leirasa (angol is johet, ha nincs magyar), sokat segitene, neten nem talaltam nagyhirtelen, csak elado keszulekeket. Meg egy kerdes, ha jol latom kb 10 csatorna allithato rajta, azt, hogy adott csatorna milyen frekvencian forgalmazzon, gondolom valamilyen hatarok kozt lehet allitani, ha igen akkor hogyan. Koszonom elore is a segitsegeteket! Igy ezt a keszuleket legalisan nem hasznalhatod. Kicsit utannaneztem, de dokumentaciot csak penzert lattam arulni. Keresgelj az interneten: Vertex.com, Yaesu.com. Kell hozza meg egy 9V-os elem, na meg a program, ami le is toltheto. Most hirtelen nem tudom honnan, de lenyeg hogy hozzaferheto. Ha szerencsed van, akkor nem kopott le a kis papir cimke az akkupack sinrol. A B C D toresu lehet ha jol tudom. Ez annyit takar, hogy milyen freki tartomanyban programozhato. Nekem is van ilyen radiom. Ja, es egyebkent a mikrofon csatin keresztul lehet progizni, tehat a fent emlitett cuccokon kivul kell meg egy 2,5-es mono jack dugo. A progi persze DOS-os.Nekem van egy laptopom amit csak radio programozasra hasznalok. Ha segitseg kell szolj, amint gep kozelbe erek segitek. Igen, jol vetted ki, abszolut amator vagyok a temaban. Keresgelek tovabb doksit. A kutyu legalis hasznalatahoz mi kell, mit lehet es mit nem legalisan hasznalni hasonszoru keszulekek kozul? A programozorol tudnal rogtonozni egy kapcsolasi rajzot. A proginak pedig utanajarok. Vuhh, 10 eve nem lattam DOS-t, de van regi gep, amin lehet ilyesmivel jatszani, szerencsere meg mukodik. A cimke sertetlen, D-s a gep ha minden igaz. Ha megakadok irok mindenkepp, es koszi meg egyszer!

Special thanks to. Valery UA6LPG for the updated PCB design. Special thanks to Gyula HA7JCA for Please do not Im from Poland. PozdravI need kpg-87d v2.xxSpsibo dobrim people kto eto delo organi. -- Irina 09.04.2006 02:14 Privet vsem! Yaesu Data Mode Cable for Handhelds Fitted with 2-jack Audio Accessory Connector This cable is a simple way of getting into data modes with the minimum of outlay. Simply download and install the drivers and software for the modes that you want to try, plug in this cable, and you are set. It is not recommended to use long data mode cables, therefore this cable is 100 cm long only. Please note that this cable does not provide CAT control. Input and output audio signals from the radio to the computer and vice versa are supplied through 1:1 bidirectional audio transformers for proper isolation of the circuit. Positive and fully automatic PTT control is supplied from the computer to the radio from USB port through the circuit based on the Prolific PL-2303TA USB to Serial Bridge Controller and the optocoupler for proper optical isolation between your computer and the radio. PTT control uses RTS line in the virtual COM port created after driver installation. As mentioned above the PTT line of this cable communicates directly with a computer through the USB port. A physical Serial Port connection is not needed since the Prolific drivers emulate a virtual Serial (COM) Port which communicates with a radio at the required TTL voltage levels. We do not write data mode programs. We also cannot properly support software, only the author of that software can. There is a lot of data mode programs can be found on the Internet.You are the light of the world. To operate your LCD TV in extreme function via an available broadcast or via HDMI, ambient conditions may cause the damage of the PC,YPBPR source. Before cleaning, unplug the TV set Disconnecting the Device from the wall outlet.

Do not use liquid The mains plug is used to disconnect the TV set or aerosol cleaners. Connection to a cable distribution system has therefore to be provided through a device providing electrical isolation below a certain frequency range (galvanic isolator, see EN 60728-11). Package Contents LCD TV Batteries: 2 X AAA Remote. Viewing the Connections - Back Connectors SCART 2 inputs or outputs for external devices. PC Input is for connecting a personal computer to the TV set. Connect the PC cable between the PC INPUT on the TV and the PC output on your PC HDMI Inputs are for connecting a device that has an HDMI socket. This memory stick to your TV by using the USB inputs may cause physical damage to the USB player and of the TV. First Connecting to a DVD Player partition of the usb disk is used for PVR ready If you want to connect a DVD player to your TV, features. It also must be formatted as primary you can use the connectors of the TV set. Auto Channel Scan Menu Operation Digital Aerial: Searches and stores aerial DVB stations. Digital Cable: Searches and stores cable DVB stations. After selecting search type as Digital Cable, you can set the desired options and press OK button to search. If you start Digital Aerial scan process, automatic scanning will start. Selected channel is now moved. Select Yes by pressing “ ” or “ ” Delete option. You can press “INFO” button to display on-screen information. Select programme will be displayed on the information Channel List item by using “. Press RETURN button to switch back to previous menu. Select a device by using “. Otherwise, recording feature will not be available.Note: This item is available when TV is not in 3D mode. Cinema Note: The backlight function will be inactive if Power This zooms up the wide picture (16:9 aspect ratio) to Save Mode is set to on. Picture menu personal preferences.IMPORTANT: Insert or remove the CI module only Dynamic Bass: Dynamic Bass is used to increase when the TV is SWITCHED OFF.

Ha legalisan szeretned hasznalni, akkor amator engedelyt kell szerezned, (vizsgaznod) es utanna lehet az UHF amator savban hasznalni. A programmozasban az elottem szolo kollega tud segiteni. Ez a tema nemigazan ebbe a topikba valo, jobb lenne a Radioamatorok topikja - ban folytatni. (ez nem CB!) A frekvencia hasznalataret dijat kell fizetned.Tobb savon, uzemmodban, stb.Ha ingyen es barmirol akarsz forgalmazni, akkor eladod es az arabol PR27 ( CB ) vagy PMR446 keszuleket veszel. Csak ugy kb., vagy zaklassam vele inkabb az NHH-t? Az enyem 458MHz korulre van programozva. Tehat a freki tatomanya ittkorul van. Sajnos a PMR frekit nem vette be (446MHz), nameg a lepeskoze( step ) se 6,25kHz-s hanem 25-os Az en programozom nem is tudom hol van eppen, de itt egy rajz. Az enyem is valami ilyesmi. Illetve az elotted szoloknak is, koszonom a segitsegeteket, most mar vilagos(abb) a tema. Keresek inkabb egy jobbfele PMR keszuleket, ezt meg hagyom a vitrinben Csakhogy nem tudod ezt megtenni, legfeljebb melleallni a frekinek. Elvileg meg ugy is mukodhet a dolog, en is radioztam mar igy, es mivel a powered is nagyobb ezert meghallananak. Visszaterve a 7010-re en sem hasznalom, inkabb vettem egy FDC-t. Ez 15eFt, 4W kijon belole csutkara toltott akksival. Igaz kinai, de tudja a 5, 6.25,12.5, 25 kHz-t. A frekitartomany 400-470Mhz Kvazi ezzel a radioval PMR frekin is tudsz ervenyesulni nagyobb powerrel, ahogyan azt meg tobb szazan (ezren) teszik. Annyit tudok a CB radiokrol,hogy CEPT-es nek kell lennie. Ezek kozul melyiket lenne erdemes megvenni resident Lincoln,vagy Albrecht CB radio. Valaszokat elore is koszonom. Antenna nem gond azt megepitem. Kulfoldrol beszelnel. Vagy csak par km-es korzetbol? Jol irtad, a CB savon viszont csak CEPT -es keszuleket hasznalhatsz, aminek van tanusitvanya is. (az FT -nek, es a Linkoln -nak nincs, az Albrecht nek nem tudom, elvileg lehet, mert gyart CEPT es CB -t is) Igy el kell dontened vagy CB, vagy amator, a kettot kombinalni nem lehet.

(legalabbis frekvencia hasznalat szempontjabol) Bovebb informaciot az adatvedelmi szabalyzatban olvashatsz. Megertettem. Soul Searching Optional. Business Development Finding customers or clients Setting up a business Career Development Climbing the career ladder How to profile yourself. Spiritual Development Meditation Religion Our database features more than 66 Instruction Manuals and User Guides in category Dishwashers haier DW12-EFM ME. User Manual, 12 pages. DW12-HFE2ME. User Manual, 6 pages. DW12-HFM. User Manual, 12 pages. DW12-HFM SS. User Manual, 12 Manuals and free owners instruction pdf guides. Find the user manual and the help you need for the products you own at ManualsOnline.Search for: Recent Posts. Search Fixya. Browse Categories A WESTPOINT WQP12-9011E DISHWASHER, USER MANUAL.We just aim to inspire personal and professional development through providing inspirational and thought provoking information. If you require personal or professional development advice we recommend that you contact one of the coaches or mentors in the Amarantine Directory. Amarantine Magazine, a division of PenCraft Books Limited, 27 Old Gloucester Street, London, WC1N 3AX, UK Registered in England and Wales: 10666673. Note: Please allow 1-3mm differs due to manual measurement. Find the user manual you need for your phone and more at ManualsOnline. Phone manuals and free pdf instructions. Queries took 0.018753 recent search for: atoll lutrana tibelec 56421 mac tronic 600 acer aspire m7711 siemens machine user manual s16 76 sagem sagem bt sh1 bluetooth sagem cx1000 3 clk uso uso brandt wfh1267f clarion dxz928r users guide buderus logan alcatel 4019 brandt aaa clas hotpoint armxxl125 orec sh 71 ariston fs36 corsair h50 banacril 42ld420 ariston duo li Electrification, automation and digitalization require innovative solutions: Discover Siemens as a strong partner, technological pioneer and responsible employer.

Discover Siemens as a strong partner, technological pioneer and responsible employer. English Set this page to ??. Go to Read online or download any manual that you need. More than 19.

ftk 4.0 manual

Use License Manager to view your current registration information, to check for product updates and to download the latest product versions, where they are available for download. You can also visit our web site, www.accessdata.com anytime to find the latest releases of our products. For more information, see Managing Licenses in your product manual or on the AccessData website. AccessData Contact Information Your AccessData Sales Representative is your main contact with AccessData. Their collective experience in working with both government and commercial entities, as well as in providing expert testimony, enables them to provide a full range of computer forensic and eDiscovery services. At this time, Professional Services provides support for sales, installation, training, and utilization of Summation, FTK, FTK Pro, Enterprise, eDiscovery, Lab and the entire Resolution One platform. They can help you resolve any questions or problems you may have regarding these solutions. Decrypting AD1 Images... Verifying Drives and Images. FTK Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence. When a full drive is imaged, a hash generated by FTK Imager can be used to verify that the image hash and the drive hash match after the image is created, and that the image has remained unchanged since acquisition. Important: When using FTK Imager to create a forensic image of a hard drive or other electronic device, be sure you are using a hardware-based write-blocker. This ensures that your operating system does not alter the original source drive when you attach it to your computer. To prevent accidental or intentional manipulation of the original evidence, FTK Imager makes a bit-for-bit duplicate image of the media. The forensic image is identical in every way to the original, including file slack and unallocated space or drive free space.

• ftk 4.0 manual, ftk 4.0 manual download, ftk 4.0 manual pdf, ftk 4.0 manual free, ftk 4.0 manual downloads.

No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher. AccessData Group, Inc.Further, AccessData Group, Inc.Further, AccessData Group, Inc.Further, AccessData Group, Inc.You may not export or re-export this product in violation of any applicable laws or regulations including, without limitation, U.S. export regulations or the laws of the country in which you reside. AccessData Group, Inc. 588 West 400 South Suite 350 Lindon, UT 84042 USA AccessData Trademarks and Copyright Information The following are either registered trademarks or trademarks of AccessData Group, Inc. All other trademarks are the property of their respective owners. Third-party trademarks and copyrights are the property of the trademark and copyright holders. AccessData claims no responsibility for the function or performance of third-party products. All rights reserved.All rights reserved.Documentation Conventions In AccessData documentation, a number of text variations are used to indicate meanings or actions. Steps that require the user to click on a button or icon are indicated by Bolded text. This Italic font indicates a label or non-interactive item in the user interface. Registration The AccessData product registration is done at AccessData after a purchase is made, and before the product is shipped. The licenses are bound to either a USB security device, or a Virtual CmStick, according to your purchase. Subscriptions AccessData provides a one-year licensing subscription with all new product purchases. The subscription allows you to access technical support, and to download and install the latest releases for your licensed products during the active license period. Following the initial licensing period, a subscription renewal is required annually for continued support and for updating your products. You can renew your subscriptions through your AccessData Sales Representative.

Note: On MS Windows Server 2008R2 running User Account Control (UAC), marking the Launch box does nothing. You must manually run FTK Imager after installation. 13. Click Finish to complete the installation and close the wizard. Installing To a Portable Device There are two ways to use Imager on a portable device: ??Copy the FTK Imager Lite files directly to the device, avoiding installing to a local computer first. Unzip the downloaded files to the portable drive and execute the file from there. The FTK Imager Lite program has fewer files (only the essentials) and does not require a separate installation, although you must unzip the downloaded file to extract its contents into a folder before use. With either method, you will need to make a target drive available for saving the imaged data, and a reliable write-blocker must still be used.To run FTK Imager using the Command Line Options 1. Close FTK Imager, then from the Windows Start Menu, click Run. 2. In the Run text box, browse to the path and folder containing FTK Imager.exe, then click Open. 3. At the end of the resulting text line: 3a. Add one space before the option you wish to use 3b. The FTK Imager UI The FTK Imager User Interface is divided into several panes; each is dockable. The Evidence Tree, File List, Properties, Hex Value Interpreter, Custom Content Sources panes, Menu, and Toolbar can all be undocked and resized to best fit your needs. Each can be re-docked individually, or you can reset the entire view for the next investigation. To undock a pane or toolbar ??Select it and click and drag its title bar to the desired location. To re-dock a pane or toolbar ??Drag the pane inside the FTK Imager window until an outline shape snaps into place in the desired position, then release the pane. Menu Bar Use the Menu Bar to access all the features of FTK Imager. The Menu Bar is always visible and accessible. There are four items on the Menu Bar. They are discussed in detail in this section.

This allows you to store the original media away, safe from harm while the investigation proceeds using the image. After you create an image of the data, you can then use AccessData Forensic Toolkit (FTK) to perform a complete and thorough forensic examination and create a report of your findings. Older versions of AccessData products cannot recognize the new v4 format. As a result, two versions of Imager are available to download and use: ??Imager 3.4.0 ??Imager 3.4.2 (and later) Use the following table to understand which products can use which AD1 format. These products can read either AD1v3 or AD1v4 image files. This version can read either AD1v3 or AD1v4 files but creates only AD1v3 files. Use this version when working with AD1 files for 5.x versions of FTK, Summation, or eDiscovery You can use this version to open an AD1v4 file and save it as an AD1v3 file. (See below) These products can read only AD1v3 files. These products can create only AD1v3 files. However, you can open a v4 file in Imager 3.4.0 (only) and save it as a v3 file. Starting with version 3.4.2, Imager is a 64-bit application. Installing Locally Install FTK Imager to a local hard drive when you intend to attach evidence hardware to that computer for previewing and imaging evidence. To install FTK Imager 1. Browse to the FTK Imager setup file, either from an installation disc, or from the saved file downloaded from The following is an example of what you will find on the web site, however, the version number and its MD5 hash number will change. AccessData Web Site: Imager Downloads 2. Under Utilities, look for FTK Imager. Click Download to download the latest released version. 3. Click Save File. 4. Browse to the location where you wish to save the install file, and click Save. 5. When the download is complete, browse to the location where it was saved. 6. Execute the setup file by double-clicking it.

The Properties Tab Properties include information such as object type, size, location on the storage media, flags, and time stamps. The Hex Value Interpreter Tab To convert hexadecimal values, highlight one to eight adjacent bytes of hexadecimal code in the Viewer. A variety of possible interpretations of the selected code are automatically displayed in the Hex Value Interpreter. This feature is most useful if you are familiar with the internal code structure of different file types and know exactly where to look for specific data patterns or time and date information. Custom Content Sources Each time you add an item to be included in a Custom Content image, it is listed here. The Custom Content Sources Tab You can add, edit, and remove one or all sources, and create the image from here. Click Edit to open the Wild Card Options dialog box. Viewer The Viewer shows the content of the currently selected file, based on the Preview Mode selected: Natural, Text, or Hex. See Preview Modes (page 22) for more information. The content can be scrolled through so you can see the entire file content. In addition, with Hex Mode selected, and the Combo Pane Hex Value Interpreter open, the hex interpretation of text selected in the Viewer pane can be viewed simultaneously. You can then choose to image the entire evidence object, or choose specific items to add to a Custom Content (AD1) image. This chapter discusses working with evidence and using FTK Imager to accomplish the creation of forensic images that meet your exact needs. Previewing Evidence Evidence items can be previewed prior to deciding what should be included in an image. Beginning with FTK Imager 3.0 support is included for VXFS, exFAT, and Ext4 file systems. W A R N I N G: If the machine running FTK Imager has an active Internet connection and you are using Imager to preview HTML content from the systems cache, there is a potential risk associated with Microsoft Security Bulletin MS-09-054.

File Menu The File menu provides access to all the features you can use from the Toolbar. View Menu The View menu allows you to customize the appearance of FTK Imager, including showing or hiding panes and control bars. Each of the viewing modes is discussed in more detail in Chapter 3. See Preview Modes (page 22). The Mode Menu Help Menu The Help menu provides access to the FTK Imager User Guide, and to information about the program version and so forth. The Help Menu Toolbar The Toolbar contains all the tools, functions, or features, that can be accessed from the File menu, except Exit. The following table provides basic information on each feature. FTK Imager Toolbar Components Button Description Add Evidence Item Add All Attached Devices Image Mounting. Opens the Map Image to Drive dialog. View Panes There are several basic view panes in FTK Imager. They are described in this section. At the root of the tree are the selected evidence sources. Listed below each source are the folders and files it contains. Click the plus sign Click the minus sign next to a source or folder to expand the view to display its sub folders.When you select an object in the Evidence Tree, its contents are displayed in the File List. The properties of the selected object, such as object type, location on the storage media, and size, are displayed in the Properties pane. Any data contained in the selected object is displayed in the Viewer pane. File List Pane The File List pane shows the files and folders contained in whichever item is currently selected in the Evidence Tree. It changes as your selection changes. Combination Pane FTK Imager’s lower-left pane has three tabs: Properties, Hex Value Interpreter, and Custom Content Sources. Each is described here. Properties The Properties tab displays a variety of information about the object currently selected in either the Evidence Tree or the File List.

Click the first, then Shift-click the last to select a block of contiguous mappings. ??Click a mapping in the list, then Ctrl-click individual mappings to select multiple non-contiguous mappings. ??Click 2. and drag to select multiple Mounted Images. Click Done to close the Mount Image to Drive dialog and return to FTK Imager. Both methods are discussed in this section. Removing a Single Evidence Item You can remove evidence items individually, or start over again by removing all evidence at once. To remove an evidence item 1. In the Evidence Tree, select the evidence item you want to remove. The evidence item is removed from the Evidence Tree. All evidence items are removed from the Evidence Tree. Without FTK Imager, users have had to image their hard drive and then extract the Registry files, or boot their computer from a boot disk and copy the Registry files from the inactive operating system on the drive. FTK Imager provides a much easier solution. It circumvents the Windows operating system and its file locks, thus allowing you to copy the live Registry files. Acquiring Protected Registry Files on a Local Machine You can acquire the Protected Registry Files using FTK Imager running on the machine whose Registry files you need. Note: These steps will not acquire Protected Files from a drive image; only from the live system running Imager. See the directions below to acquire Protected Files from a drive image. The use of encrypted images is discussed below. Detecting EFS Encryption You can check for encrypted data on a physical drive or an image with FTK Imager. The program scans the evidence and notifies you if encrypted files are located. As illustrated in the figure above, EFS Encrypted files are indicated by a key icon, Chapter 4 Working With Evidence, in the Evidence Tree. This feature is know as AD Encryption. AD Encryption Credentials Options Certificates use public keys for encryption and corresponding private keys for decryption. ??

To encrypt with a password, mark Password, then type and re-type the password to use. ??To encrypt with a certificate, mark Certificate then browse to the certificate to use. AFF Encryption New beginning in FTK Imager 3.0 is the ability to create images using AFF Encryption. When you create an AFF encrypted image, a password is required. If you wish to open that encypted image later, you will need to supply the password that was used when it was created. In addition, drive content and hash lists can be exported. This chapter discusses the available options. Creating Forensic Images FTK Imager allows you to write an image file to a single destination or to simultaneously write multiple image files to multiple destinations using the same source data or drive. Imaging Complete Drives or Partitions Important: The following important information should be reviewed and understood prior to imaging complete drives or complete partitions on drives: ??When using FTK Imager to create a forensic image of a hard drive, be sure you are using a hardwarebased write-blocking device. This ensures that your operating system does not alter the hard drive when you attach it to your imaging computer. ??When exporting data to an image from an encrypted drive, create the image physically, not logically. A physical image is often required for decrypting full disk encryption. Select Source 2. In the Select Source dialog box, select the source you want to make an image of. Imager will automatically increment the case numbers with each image, and if something interrupts the process, you may assign case number manually. 5. Select the drive or browse to the source of the image you want, and then click Finish. 6. In the Create Image dialog, click Add. Create Image ??Compare the stored hashes of your image content by checking the Verify images after they are created box. If a file doesn’t have a hash, this option will generate one. ??

AccessData recommends that, wherever possible, users not have an active internet connection while Imager is running. Preview Modes FTK Imager offers three modes for previewing electronic data: Automatic mode, Text mode, and Hex mode. These modes are selectable from the Mode menu, or from the Toolbar, as introduced in Chapter 2. Each is described in more detail here. Automatic Mode Automatic mode automatically chooses the best method for previewing a file’s contents, according to the file type. For example: ??Web pages, Web-related graphics (JPEGs and GIFs), and any other media types for which Internet Explorer plug-ins have been installed are displayed by an embedded version of Internet Explorer in the Viewer. ??Text files are displayed in the Viewer as ASCII or Unicode characters. ??File types that cannot be viewed in Internet Explorer are displayed outside of FTK Imager in their native application provided those applications are installed locally, and the appropriate file associations have been configured in Windows. ??File types that cannot be viewed in Internet Explorer and that do not have a known native viewer are displayed by default in Hexadecimal Mode in the Viewer. This mode can be useful for viewing text and binary data that is not visible when a file is viewed in its native application. Hex Mode Hex mode allows you to view every byte of data in a file as hexadecimal code. You can use the Hex Value Interpreter to interpret hexadecimal values as decimal integers and possible time and date values. Note: Preview modes apply only when displaying file data. The data contained in folders or other non-file objects is always displayed in hexadecimal format. These procedures are explained in this section. The Add All Attached Devices function, also known as auto-mount, scans all connected physical and logical devices for media. If no media is present in an attached device such as a CD- or DVD-ROM or a DVD-RW, the device is skipped.

Image Mounting New beginning in version 3.0 of FTK Imager, Image Mounting allows forensic images to be mounted as a drive or physical device, for read-only viewing. This action opens the image as a drive and allows you to browse the content in Windows and other applications. Partitions contained within full disk images, as well as Custom Content Images of AD1 and L01 formats can be mounted Logically. The differences are explained in this section. Note: AD encrypted images can now be mounted as either a drive or a physical device. Other types of encrypted images are not supported for mounting as either a drive or physical device. Thus, these images do not have the option of being mounted Physically. However, when you open the “drive” from there, the folders and files contained within the mounted image do display correctly. Characteristics of a Physically Mounted Image When you mount an image physically, while it cannot be viewed by Windows Explorer, it can be viewed outside of Imager using any Windows application that performs Physical Name Querying. A physical disk image can be mounted Physically; and its disk image partition(s) can be mounted Logically. Type in the path and filename, or click Browse to populate the Source box with the path and filename of the image to be mounted. After selecting an image, the Mount Type will default to the supported mapping based on the image type selected. Click the drop-down to display other available Mount Types. Mount Image to Drive 4. Select the Mount Type to use for mounting.If selected, provide path information for the cache file in the Write Cache Folder field. All the related mount information will be displayed in the Mapped Image List. You can continue to mount images as needed, until you run out of evidence to add, or mount points to use. Mounted images remain available until unmounted, or until Imager is closed. 10. Click Close to return to FTK Imager. To unmount multiple mappings 1. Choose one of the following: ??

List the entire contents of your images with path, creation dates, whether files were deleted, and other metadata. The list is saved in tab-separated value (.TSV) format. 7. Select the type of image you want to create. Hashes are not generated for CD and DVD images so they will not be verified, as well. If you select the Raw (dd) type, be sure to have adequate available drive space for the resulting image. 7a. If you are creating an AFF image type, choose AFF. The Image Destination Folder dialog box you see will be different than that seen when selecting ay other image type Select Image Type with AFF Selected. 7b. 8. Click Next. Specify Evidence Item Information. All Evidence Item Information is optional, but it is helpful to have the information easily accessible in case it is called into question at any time after creation Evidence Item Information 9. Complete the fields in the Evidence Item Information dialog. Note: If the destination folder you select is on a drive that does not have sufficient free space to store the entire image file, FTK Imager prompts for a new destination folder when all available space has been used in the first location. To encrypt the new image with AD Encryption, mark the Use AD Encryption box. 14b. To encrypt the new image with AFF Encryption, mark the Use AFF Encryption box. Click Finish. For more information, see Detecting EFS Encryption (page 32). 16. When AD Encryption is selected, you can choose between encrypting with a password, or encrypting with a certificate. AD Encryption Credentials If you use a password, you must type, then retype that password to confirm. ??Click Show Password to display the password in plain text as you type it the first time, to verify you are typing it correctly. ??Uncheck Show Password to replace the characters with asterisks. 16a. When AFF Encryption is selected, type the password, and retype the password to confirm. AFF Encryption 16b.

Click Show Password to see that you have typed it correctly the first time. 17. When encryption selections are made, click OK to save selections and return to the Create Image dialog. Click it to open the Image Summary window as shown below: Image Summary The Image Summary also includes the data you entered in the Evidence Item Information dialog. 22. Click OK to close the Image Summary. 23. Click OK to return to the Creating Image dialog. 24. Click Close to exit back to Imager. With the Custom Content Image feature, you can select specific files from a live file system or an existing image to make a smaller, more specific image. You can also search an existing image using a wild-card character to create a custom image having only those files that fit your exact criteria. Custom Images serve investigators who must acquire evidence quickly, or who need only particular items of information to create evidence. Images can also be customized to fit on a thumb-drive or other portable media. Note: When exporting the contents of a folder to a Custom Content Image (AD1), or Logical Image (AD1), if a file in the folder being exported is locked (in use by another process or program), an error message pops up showing the problem and the name of the file that is in use. Select Add to Custom Content Image (AD1). The item is listed in the Custom Content Sources pane. Custom Content Sources Note: The Custom Content Sources pane is dockable; that is, you can move it to any corner of the Imager window, or you can even undock it from the Imager window entirely, and drag it to a second monitor screen. 3. Continue adding content by repeating this step until you’ve specified or selected all the evidence you want to add to this Custom Content image. You can change the items in your custom image list. Use the New and Remove buttons to include or exclude items, and the Edit button to open the Wild Card Options dialog.

It eliminates the need to right-click each node in the evidence tree and selecting Add to Custom Content Image (AD1) one by one. For example, if you wanted to collect all files ending in.doc that reside in all folders named My Documents, FTK Imager would search all the added evidence for each occurrence of My Documents, and then collect all.doc files under that directory. Unchecking Include Subdirectories causes Imager to find only the files in the root of the My Documents folder. 4. When all Custom Content Sources have been identified and added, click Create Image. All evidence item information is optional, but it is helpful to have the information easily accessible in case it is called into question at any time after creation. For more information, see Step 9 under “Creating Forensic Images” beginning on page 35. 9f. Choose whether to Filter by File Owner. For more information, see Exporting By SID (page 47). 10. Click Finish in the Select Image Destination dialog to save these settings and return to the Create Image dialog. 11. To add another image destination (i.e., a different, additional saved location), click Add and repeat steps 5 through 8. 12. To change an image destination, select the destination to change and click Edit. 13. To delete an image destination, select the destination and click Remove. 14. Mark the additional options as desired: ??Check Verify Images after they are created to check the image hash signature. This detects whether the content of the original data has changed since it was copied to the image. ??Check Create directory listings of all files in the image to record the file names and paths of the image contents. This record will be saved in Microsoft Excel format, and often functions as evidence. ??Check Precalculate Progress Statistics to see approximately how much time and storage space creating the custom image will require before you start, and as the imaging proceeds. Click Start to begin the export process.

A progress dialog appears showing the following: ??The source image file that is being exported ??The location where the new image is being saved ??The status of the export process ??A graphical progress bar ??The amount of data in MB that has been copied and the total amount to be copied ??Elapsed time since the export process began ??Estimated time left until the process is complete Creating Image (Progress Window) 16. By default, when the image creation is complete, a status box opens to display a window showing the files and the hashes (MD5 and SHA1) of your custom image. 16a. Click Close when you are done viewing the hash information. 16b. Click Close again to return to the Creating Image dialog. At this point, the Status window will say Image Created Successfully. 17. Click Image Summary to open the Image Summary window that displays the Image Creation Log Evidence Item Information you entered at the beginning. 18. Click OK to return to the Creating Image dialog. 19. Click Close to exit back to Imager. Each is discussed below. Exporting Forensic Images Convert an existing image file to a different format by exporting it, and choosing a different image format from the original. Export whole image files to convert them from one format type to another. Export selected contents of a drive or image to create a Custom Content Image (AD1). Exporting Files Exporting or copying files from an evidence item allows you to print, e-mail, salvage files, or organize files as needed, without altering the original evidence. Note: This feature comes in handy if your OS fails, but the drive is still operational. Image your drive and export your data, photos, etc.The folder’s contents are displayed in the File List. 2. In the File List, select the files you want to export. 3. ??Click the first, then Shift-click the last to select a block of contiguous files. ??Click a file, then Ctrl-click individual files to select multiple non-contiguous files.

Exporting By SID Windows assigns unique identifiers to each process, user, machine, and so forth within its system. A system identifier (SID) is unique to the system, and most often applies to users. The Export to Logical Image (AD1) and Add to Custom Content Image (AD1) features now allow the user to select and export files owned by particular SID(s), or add them to the image. This will take you to the same screen you would see if you had directly selected Export Logical Image. 5. In the Create Image dialog box, click Add to specify an image destination Create Image. 6. Specify Evidence Item Information. In the Choose File Owners dialog box, mark the names of the Users and their SIDs whose files you want to export. 15a. If the desired SID does not appear on the list, click Add to manually enter one. Copy and paste the SID from another location, or type it in manually. This allows a user to create an image containing files owned by the SID of a domain account. This value can then be used to prove that a copy of a file has not been altered in any way from the original file. It is computationally infeasible for an altered file to generate the same hash number as the original version of that file. The Export File Hash List feature in FTK Imager uses the MD5 and SHA1 hash algorithms to generate hash numbers for files. To generate and export hash values to a list 1. In the Evidence Tree, select the folder that contains the objects you want to hash. The object’s contents are displayed in the File List. 2. In the File List, select the folders or files you want to hash. If you select a folder, all the files contained in the folder and its sub folders are hashed. Note: Click the first, then Shift-click the last to select a block of contiguous files. Evidence Item Information When creating or exporting a forensic image, you can enter information and notes about the evidence contained in the image you are creating.

ftk 1.80 manual

Instead, they create an exact replica of the files and work on this image to ensure that the original files remain intact. To verify the files they are working on have not been altered, investigators can compare a hash of the original files at the time they were seized with a hash of the imaged files used in the investigation. Hashing provides mathematical validation that a forensic image exactly matches the contents of the original computer. Another important legal element in computer forensics is the continuity, or chain of custody, of computer evidence. The2 Forensic Toolkit User Guide Forensic investigators must be able to account for all that has happened to the evidence between its point of acquisition or seizure and its eventual appearance in court. There are many cases in which personnel trained in information technology have made incriminating computer evidence legally inadmissible because of their reckless or ill- conceived examinations. Only properly trained computer forensics specialists should obtain and examine computer evidence.Role of Forensic Toolkit When you acquire computer evidence, you can use FTK ImagerTM to create an image of the source drives or files. You can also create a hash of the original image that you can later use as a benchmark to prove the validity of your case evidence. FTK Imager verifies that the image hash and the drive hash match when the image is created. After you create the image and hash the data, you can then use FTK to perform a complete and thorough computer forensic examination and create a report of your findings. For a big-picture view of FTK, see“FTK Overview” on page 5.Other AccessData Products In addition to FTK and FTK Imager, AccessData offers other industry-leading products. Preface 3 AccessData has multiple tools available for password recovery: Password Recovery ToolkitTM (PRTKTM) has a wide variety of individual password-breaking modules that can help you recover lost passwords.

• ftk 1.80 manual, ftk 1.80 manual pdf, ftk 1.80 manual download, ftk 1.80 manual free, ftk 1.80 manual 2017.

If you continue browsing the site, you agree to the use of cookies on this website. See our User Agreement and Privacy Policy.If you continue browsing the site, you agree to the use of cookies on this website. See our Privacy Policy and User Agreement for details.If you wish to opt out, please close your SlideShare account. Learn more. You can change your ad preferences anytime. Check out, please ? www.HelpWriting.net ?This awesome company. After I was continuously complaining to my family and friends about the ordeals of student life. They wrote my entire research paper for me, and it turned out brilliantly. I highly recommend this service to anyone in my shoes. ? www.WritePaper.info ?.It depends on the individual skill set also. You can get help from research paper writing. Check out, please ? www.HelpWriting.net ?Save so as not to loseFurther, AccessData Corp.Further, AccessData Corp. All rights reserved. No part of this publication may be reproduced,photocopied, stored on a retrieval system, or transmitted without the express written consent ofthe publisher.Version 1.80.0May 22, 2008AccessData Corp.384 South 400 WestLindon, Utah 84042U.S.A.www.accessdata.comii Forensic Toolkit User Guide FTK features powerful file filtering and searchfunctionality and is recognized as the leading forensic tool fore-mail analysis.This chapter contains the following sections: “Audience” on page 2 “Handling Evidence” on page 2 “Role of Forensic Toolkit” on page 3 “Other AccessData Products” on page 3 1 This type of evidence is fragile and can easily, even inadvertently, be altered, destroyed, or rendered inadmissible as evidence. Computer evidence must be properly obtained, preserved, and analyzed to be accepted as reliable and valid in a court of law. To preserve the integrity of case evidence, forensic investigators do not work on the original files themselves.

The forensic image is identical in every way to the original, including file slack and unallocated space or free space. For information about file slack and unallocated space, see the Glossary on page 343. FTK Overview 7 Hash values are used to verify file integrity and identify duplicate and known files. (Known files are standard system files that can be ignored in your investigation as well as known illicit or dangerous files.) Two hash functions are available in FTK and FTK Imager: Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1). By default, FTK creates MD5 hashes. The hashing options are selected automatically by FTK based on the KFF databases that are available. For more information about KFF, see “Known File Filter” on page 9. The following graphic shows a sample file with a list of MD5 and SHA-1 hashes. Typically, you hash individual files to compare the results with a known database of hashes, such as KFF. However, you can also hash multiple files or an image to verify that the working copy is identical to the original. You can create hashes with FTK Imager or FTK. For information on creating hashes with FTK, see “Selecting Evidence Processes” on page 65.8 Forensic Toolkit User Guide The purpose of KFF is to eliminate ignorable files (such as known system and program files) or to alert you to known illicit or dangerous files. It also checks for duplicate files. Files which contain other files, such as Zip and e-mail files with attachments, are called container files. When KFF identifies a container file as ignorable, FTK does not extract its component files. When KFF is used, the evidence is separated into ignored files (such as system files) and evidence that you continue to examine. KFF includes the HashKeeper database, which is updated periodically and is available for download on the FTK update page ( ). For information on defining the location of the KFF database, see “KFF Database Location” on page 259.

For more information about PRTK, the AccessData Website ( ). Rather than using a single machine, DNA uses machines across the network or across the world to conduct key space and dictionary attacks. For more information about DNA, the AccessData Website ( ).FTK 2.0 The most comprehensive AccessData product for forensic investigation is FTK 2.0. It includes all the PRTK recovery modules, a 50-client license for DNA, and a one-year upgrade subscription for all of the included products. Any products and upgrades purchased in that year do not expire. For more information about FTK 2.0, the AccessData Website ( ).4 Forensic Toolkit User Guide The chapter contains the following sections: “The Big Picture” on page 6 “Acquiring and Preserving the Evidence” on page 7 “Analyzing the Evidence” on page 8 “Presenting the Evidence” on page 10 5 Acquire and Preserve the Evidence Workstation Target Analyze the Case Prepare a Report Case Report The concepts behind each of these steps are discussed in the following sections.6 Forensic Toolkit User Guide There are two ways to achieve this: by creating an image of the suspect drive using hardware devices or by using software applications. Hardware acquisition tools duplicate disk drives or allow read- only mode access to a hard drive. For more information about hardware tools, see “Industry and Third-Party Contacts” on page 321. Software acquisition tools create a forensically sound image that makes no changes to the data or information on the suspect hard drive. The forensic image must be identical in every way to the original. As a rule, no changes to the evidence should be made. FTK Imager is a software acquisition tool. It can be used to quickly preview evidence and, if the evidence warrants further investigation, create a forensically sound image of the disk. To prevent against accidental or intentional manipulation of evidence, FTK Imager makes a bit-by-bit duplicate image of the media.

10 Forensic Toolkit User Guide The chapter is divided into the following sections: “Supported File Systems and Image Formats” on page 13 “System Preparation” on page 14 “Basic Installation” on page 15 “Upgrade Instructions” on page 27 “Uninstalling” on page 30 11 A good understanding of the workstation and its configured devices will help ensure that FTK runs at its best. Consider the following: Role of the workstation Determine if it will be used as a regular user workstation, a forensic analysis workstation, or a password recovery workstation. Access policy Identify where the workstation will be located, who can access the information, and when the cases can be worked on. Hardware and software requirements For the hardware and software requirements, see “System Requirements” on page 12. Application relationships Verify that the applications can work simultaneously. Do not run so many applications that you compromise overall performance. Network and Internet issues Determine if the workstation should be connected to a network or the Internet. Under normal circumstances, the forensic analysis workstation will not be connected to the Internet to avoid the possible tainting of evidence. System policies and procedures Check with your system administrator about any specific policies and procedures that may exist.14 Forensic Toolkit User Guide The installation is divided into three parts: Install the Forensic Toolkit: FTK 1.70.0 and later will install in locations separate from FTK 1.6 or earlier. Your older versions of FTK and their cases will not be affected by installing FTK 1.70. Warning: FTK 1.70.0 has an upgraded database, increasing the limit on how many items a case can contain. This enhancement, however, renders FTK 1.70.0 incompatible with earlier versions. Cases processed in earlier versions of FTK cannot be opened in FTK 1.70.0, and cases processed in 1.70.0 cannot be opened in earlier FTK versions. FTK Imager is now a separate installation.

Searching With FTK, you can conduct a live search or an indexed search. A live search is a time-consuming process involving an item-by- item comparison with the search term. Live searches allow you to search non-alphanumeric characters and perform regular expression searches. Note: Regular expressions are mathematical statements that describe a data pattern such as a credit card or social security number. Regular expression searches allow you to find data items that conform to the pattern described by the expression. FTK provides several pre-defined regular expressions such as U.S. phone number, U.K. phone number, credit card number, social security number, and IP address. The indexed search uses the index file to find a search term. The index file contains all discrete words or number strings found in both the allocated and unallocated space in the case evidence. FTK Overview 9 For more information on searching, see “Searching a Case” on page 149.Presenting the Evidence FTK presents computer evidence by creating a case report and case log to document the evidence and investigation results. FTK uses the Report Wizard to create and modify reports. In the report, you can add bookmarks (information you selected during the examination), customize graphics references, select file listings, and include supplementary files and the case log. You can also export selected files with the report, such as bookmarked files and flagged graphics, so they are available with the report. The report is generated in HTML. The case log assists in documenting and logging activities during the investigation and analysis of a case. This information can be used as part of a report or to identify what has occurred if you are assigned to an investigation in progress. The case log is created automatically by the FTK and is called ftk.log. For information about creating a report, see “Working with Reports” on page 221.

Installing KFF from CD To install KFF from CD: 1 Insert the CD into the CD-ROM drive and click Install the Known File Filter Library. Browse to the CD-ROM drive and select Autorun.exe. 2 Click Next on the Welcome screen. 3 Select I Accept the Terms of the License Agreement and then click Next.18 Forensic Toolkit User Guide The default directory is c:Program FilesAccessDataAccessData Forensic ToolkitProgram. Important: If you install KFF to another directory, you must indicate the new location in FTK Preferences. For more information, see “KFF Database Location” on page 259. 5 Click Next. 6 Click Finish.Basic Install from Downloadable Files FTK downloadable files are available from the AccessData Website ( ). To download the FTK program files: 1 Go to the AccessData downloads page. 2 Under Forensic Toolkit, click Updates. 3 Download the program files you would like to install. If this is the first time you have installed FTK, download both FTK and the dongle driver. If you want to eliminate ignorable and duplicate files, and be alerted of known illicit or contraband files, you also need to download the KFF database.The default directory is c:Program FilesAccessDataAccessData Forensic Toolkit. To specify a different directory, click Browse, select the location, and click OK. 8 Click Next. 9 Check the box to run FTK if you want it to automatically start after you complete the installation. If you run FTK but haven’t installed the KFF database, you will receive an error message at the end of the installation saying that the KFF Hash Library is not found and certain features will be disabled. You can install the dongle drivers and KFF from the downloadable files. For installation instructions, see “Installing the Dongle Drivers from Downloadable Files” on page 21. 10 Check the box to run LicenseManager if you want it to automatically check for updates.20 Forensic Toolkit User Guide For more information on LicenseManager, see “Managing Licenses” on page 263.

See “Installing LicenseManager from CD” on page 23 or “Installing LicenseManager from Downloadable Files” on page 26. 11 Click Finish.Installing the Dongle Drivers from Downloadable Files Installing the KEYLOK (green) Dongle Driver To install the dongle drivers from downloadable files: 1 On the Forensic Toolkit Download page, click the dongle drivers install. 2 Save the dongle install file (dongle.exe) to a temporary directory on your drive. 3 To launch the install program, go to the temporary directory and double-click the dongle install file (dongle.exe). 4 Click Install. 5 Click Next to install the driver. 6 If you have a USB dongle, verify that it is not plugged in. If you have a parallel port dongle, verify that it is plugged in. 7 Designate the dongle driver directory by doing one of the following: To accept the default directory, click Next. To specify a different directory, click Browse, select the location, and click OK. 8 Click Next. 9 If you have a USB dongle, plug it in. 10 Click Finish. Installing the Forensic Toolkit 21 Click Install CodeMeter Software to launch the CodeMeter installation wizard, as displayed in the following figure.CodeMeter Installation Wizard 5 Follow the directions for installation, accepting all defaults, and click Finish to complete the installation.Installing KFF from Downloadable Files To install KFF from downloadable files: 1 On the Forensic Toolkit Download page, click KFFInstall.exe. 2 Save the KFF install file (kffinstall.exe) to a temporary directory on your drive.22 Forensic Toolkit User Guide The default directory is c:Program FilesAccessDataAccessData Forensic ToolkitProgram. For more information, see “KFF Database Location” on page 259. 7 Click Next, then click Finish.Installing LicenseManager from CD LicenseManager lets you manage product and license subscriptions using a dongle or dongle packet file. For more information, see “Using LicenseManager” on page 55.

Install the Known File Filter Library: Installs the Known File Filter (KFF) database, a utility that compares file hashes in your case against a database of hashes for known system and program files as well as known illicit and contraband files. To preserve work done on earlier versions of FTK, your 1.70.0 KFF will be installed in the 1.70.0 directory without overwriting any previously installed KFFs. To economize disk space, you may choose to manually delete older versions of your KFF. To point any version of FTK to the new KFF, go to the Tools menu, then type in the path in the Preferences dialog. For additional information about KFF, see “Known File Filter” on page 9. Launch Dongle Driver Setup: Installs the driver for either the USB or parallel port dongle. The dongle is required to use FTK and it should be stored in a secure location when not in use. Each part can be independently installed, although FTK and the dongle driver must be installed for FTK to work properly. If you want to eliminate ignorable and duplicate files, and be Installing the Forensic Toolkit 15 For troubleshooting information on the FTK install, see “Troubleshooting” on page 275.Basic Install from CD The following sections review installing FTK, the dongle drivers, and KFF from CD.Installing FTK from CD To install FTK from CD: 1 Insert the CD into the CD-ROM drive and click Install the Forensic Toolkit. If auto-run is not enabled, select Start, and then Run. Browse to the CD-ROM drive and select Autorun.exe. 2 Click Next on the Welcome screen. 3 Select I Accept the Terms of the License Agreement and then click Next. 4 Designate the program directory by doing one of the following: To accept the default directory, click Next. The default directory is c:Program FilesAccessDataAccessData Forensic Toolkit. To specify a different directory, click Browse, select the location, and click OK. 5 Click Next.

6 Check the box to run FTK if you want it to automatically start after you complete the installation. If you check the box to run FTK but haven’t installed the dongle drivers, you will receive an error message and FTK will not start. If you run FTK but haven’t installed the KFF database, you will receive an error message at the end of the installation16 Forensic Toolkit User Guide You can install the dongle drivers and KFF from the CD. For installation instructions, see “Installing the Dongle Driver from CD” on page 17 and “Installing KFF from CD” on page 18. 7 Check the box to run LicenseManager if you want it to automatically check for updates. LicenseManager automatically checks the AccessData Website for software updates. For more information on LicenseManager, see “Managing Licenses” on page 263. If LicenseManager is not installed, a warning is displayed. See “Installing LicenseManager from CD” on page 23 or “Installing LicenseManager from Downloadable Files” on page 26. 8 Click Finish.Installing the Dongle Driver from CD Installing the KEYLOK (green) Dongle Driver 1 Insert the CD into the CD-ROM drive and click Launch Dongle Driver Setup. Browse to the CD-ROM drive and select Autorun.exe. 2 Click Next to install the driver. 3 If you have a USB dongle, verify that it is not plugged in. If you have a parallel port dongle, verify that it is plugged in. Click Next after meeting the above conditions. 4 Designate the dongle driver directory by doing one of the following: To accept the default directory, click Next. The default directory is c:Program FilesAccessDataDongle Driver. To specify a different directory, click Browse, select the location, and click OK. Installing the Forensic Toolkit 17 Click Install CodeMeter Software to launch the CodeMeter installation wizard, as displayed in the following figure. 2 Follow the directions for installation, accepting all defaults, and click Finish to complete the installation.

To install LicenseManager: 1 Insert the CD into the CD-ROM drive and click Install LicenseManager. Browse to the CD-ROM drive and select Autorun.exe. Installing the Forensic Toolkit 23 The default directory is C:Program FilesAccessDataAccessData LicenseManager. To specify a different location, click Browse, select the location, click OK, and the click Next.5 If you want to launch LicenseManager after completing the installation, select Run LicenseManager. Installing the Forensic Toolkit 25 You can also start LicenseManager in FTK, by clicking Help, and then Launch LicenseManager.Installing LicenseManager from Downloadable Files LicenseManager lets you manage product and license subscriptions using a dongle or dongle packet file. To install LicenseManager: 1 Go to the AccessData download page ( ). 2 On the download page, click LicenseManager. 3 Save the dongle installation file (LicenseManager.exe) to a temporary directory on your drive. 4 To launch the installation program, go to the temporary directory and double-click the dongle installation file (LicenseManager.exe). 5 Click Install.26 Forensic Toolkit User Guide For example, you can upgrade to a newer version of FTK without upgrading the KFF database. Important: You do not need to upgrade the dongle drivers unless notified by AccessData. You can upgrade the version of FTK from a CD or from downloadable files available on the AccessData Website ( ). To be notified via e-mail when FTK upgrades are available, go to the Update Notification page on the AccessData Website ( ). For troubleshooting information on upgrading FTK, see “Troubleshooting” on page 275.Upgrading from CD Typically you will upgrade from downloadable files. If you want to upgrade from CD, contact AccessData. For contact information, see “Technical Support” on page 341.Upgrading FTK from CD To upgrade FTK from CD: 1 Insert the CD into the CD-ROM drive and click Install the Forensic Toolkit. Browse to the CD-ROM drive and select Autorun.exe.

2 Select Install the Newer Version and click Next. 3 Check the box to run FTK if you want it to automatically start after you complete the installation. 4 Check the box to run LicenseManager if you want it to automatically check for updates. Installing the Forensic Toolkit 27 For more information on LicenseManager, see “Managing Licenses” on page 263. See “Installing LicenseManager from CD” on page 23 or “Installing LicenseManager from Downloadable Files” on page 26. 5 Click Finish.Upgrading KFF from CD If you have added your own hashes to the KFF database, see “Upgrading a Customized KFF” on page 30 for instructions on how to upgrade the KFF database without overwriting the hashes you have added. If you have not customized the KFF library, simply re-install the KFF from CD. To upgrade a basic KFF from CD: 1 Insert the CD into the CD-ROM drive and click Install the Known File Filter Library. 2 Select Replace My KFF with This Version and click Next. 3 Click Finish.Upgrading from Downloadable Files FTK downloadable files are available from the AccessData Website ( ). To download the FTK program files: 1 Go to the AccessData downloads page. 2 Under Forensic Toolkit, click Updates. 3 Download the program files you would like to install.Upgrading FTK from Downloadable Files To upgrade FTK from downloadable files:28 Forensic Toolkit User Guide Note: Your custom column settings and filters are not overwritten. 6 In the install program, select Install the Newer Version and click Next. 7 Check the box to run FTK if you want it to automatically start after you complete the installation. 8 Check the box to run LicenseManager if you want it to automatically check for updates. See “Installing LicenseManager from CD” on page 23 or “Installing LicenseManager from Downloadable Files” on page 26. 9 Click Finish.

Upgrading KFF from Downloadable Files If you have customized the KFF library by adding your own hashes, you need to follow the instructions in “Upgrading a Customized KFF” on page 30. These instructions will prevent the overwriting of the hashes you have added. If you have not customized the KFF library, simply re-install the KFF from the downloadable files. To upgrade a basic KFF from downloadable files: Installing the Forensic Toolkit 29 The FTK interface contains six main windows, organized like tabbed pages, each with a particular focus or function. Most windows also contain a common toolbar and file list with columns. Note: Viewing large items in their native applications is often faster than waiting for them to be rendered in an FTK viewer. This chapter discusses the interface in the following sections: “Starting FTK” on page 32 “Overview Window” on page 34 “Explore Window” on page 39 “Graphics Window” on page 40 “E-mail Window” on page 41 “Search Window” on page 42 “Bookmark Window” on page 45 “Toolbar Components” on page 48 “File List Columns” on page 51 “FTK Imager” on page 54 “Using LicenseManager” on page 55 31 Virus scanners can slow FTK performance significantly.32 Forensic Toolkit User Guide If the correct version isn’t found, an error message will display.Using the Dongle AccessData provides a parallel or USB dongle with FTK. The dongle is a security compliance device that you insert into the parallel or USB port during installation. It maintains your FTK licensing and subscription information and is required to use FTK. For information on installing the dongle drivers, see “Installing the Dongle Driver from CD” on page 17 or “Installing the Dongle Drivers from Downloadable Files” on page 21. You can use the License Manager to monitor your FTK subscription. For more information, see “Using LicenseManager” on page 55.

Using the FTK Startup Menu When you start FTK, the Simple Start menu appears with the following options: Start a new case For detailed information on starting a new case, see “Starting a New Case” on page 59. Open an existing case For detailed information on working with existing cases, see “Working with Existing Cases” on page 93. Preview evidence This option opens FTK Imager. For more information, see “FTK Imager” on page 54. Go directly to working in program Getting Started 33 Don’t show this dialog on start-up again. Mark this option if you do not want the FTK Startup menu to appear when you start FTK. If you want the FTK Startup menu to appear after you have set it to not appear, click Tools, then Preferences, and then Show Startup Dialog. Overview Window The Overview window provides a general view of a case. Viewer Toolbar General Case Information Viewer File List Toolbar File List34 Forensic Toolkit User Guide Now customize the name of a clipboard to store your clips. Discover everything Scribd has to offer, including books and audiobooks from major publishers. Report this Document Download Now Save Save FTK 1.80 Manual For Later 100% (1) 100% found this document useful (1 vote) 4K views 365 pages FTK 1.80 Manual Uploaded by Adam Smith Description: Full description Save Save FTK 1.80 Manual For Later 100% 100% found this document useful, Mark this document as useful 0% 0% found this document not useful, Mark this document as not useful Embed Share Print Download Now Jump to Page You are on page 1 of 365 Search inside document Browse Books Site Directory Site Language: English Change Language English Change Language. Legal Notices AccessData Corp.F urther, AccessData Corp.Further, AccessData Corp.Further, AccessData Corp.All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or tran smitted without the express written consent of the publisher. Version 1.80.0 May 22, 2008 AccessData Corp.

384 South 400 West Lindon, Utah 84042 U.S.A. www.accessdata.com AccessData Trademarks AccessData is a registered trademark of AccessDa ta Corp. Distributed Network Attack is a registered tradem ark of AccessData Corp. DNA is a registered trademark of AccessData Cor p. Forensic Toolkit is a registered trademark of Acc essData Corp. FTK is a trademark of AccessData Corp. FTK Imager is a trademark of AccessData Corp. Known File Filter is a trademark of AccessData Co rp. KFF is a trademark of AccessData Corp. LicenseManager is a trademark of AccessData Co rp. Password Recovery Toolkit is a trademark of Acce ssData Corp. PRTK is a trademark of AccessData Corp. Registry Viewer is a trademark of AccessData Cor p. Ultimate Toolkit is a trademark of AccessData Co rp. Third-Party Trademarks All third-party trademarks are the property of the ir respective owners. FTK features powe r ful file filtering and search functionality and is recognized as the leading forensic tool for e-mail analysis. This chapter contains the following sections: ? “Audience” on page 2 ? “Handling Evidence” on page 2 ? “Role of Forensic T oolkit” on page 3 ? “Other AccessData Products” on page 3 Audience The Forensic T oolkit User Guide is written for law enforcement and corporate security professionals with the following competencie s. Basic knowledge of and training in forensic policies and procedures. Basic knowledge of and experience with personal computers. Familiarity with the fundamentals of collecting digital evidence. Understanding of forensic images and how to acquire forensically sound images. Experience with case studies and reports. Familiarity with the Microsoft Windows environment Handling Evidence Computer forensics involves the acquisition, preservation, analysis, and presentation of comput er evidence. This type of evidence is fragile and can easily, even inadvertently, be altered, destroyed, or render ed inadmissible as evidence.

ftir-8400s manual

See our User Agreement and Privacy Policy.If you continue browsing the site, you agree to the use of cookies on this website. See our Privacy Policy and User Agreement for details.If you wish to opt out, please close your SlideShare account. Learn more. You can change your ad preferences anytime. Shimadzu was the first company to offer dynamic alignment as a standard feature in an affordable FTIRFTIR-8400S is combined with the IRsolution - a 32 bit high performance FTIR software - to analyze yourT h e I R s o l u t i o n A dva n t ag eCable Add.:SHIMADZU TOKYO Phone: (55)11-3611-1688 Fax. (55)11-3611-2209Phone: 1(410)381-1227 Fax. 1(410)381-1222 Toll Free: 1(800)477-1227 Phone: (852)2375-4979 Fax. (852)2199-7438. SHIMADZU EUROPA GmbH SHIMADZU INTERNATIONAL TRADING (SHANGHAI) Co., LTD. SHANGHAI OFFICE. Albert-Hahn-Strasse 6-10, 47269 Duisburg, F.R. Germany Phone: 49(203)7687-0 Fax. 49(203)766625 24th Floor, Shanghai Xin Hualian Building, No.755 Huaihai Zhong Lu, Shanghai, ChinaPhone: 65-6778-6280 Fax. 65-6779-2935 Istanbul, MoscowPhone: 61(2)9684-4200 Fax. 61(2)9684-4055Now customize the name of a clipboard to store your clips. The connection's current state is open. Please review the stack trace for more information about the error and where it originated in the code.The connection's current state is open. Source Error: Information regarding the origin and location of the exception can be identified using the exception stack trace below. The IR source mirror seemed ” The item may have some signs of cosmetic wear, but is fully operational and functions as intended. This item may be a floor model or store return that has been used. See the seller’s listing for full details and description of any imperfections. The IR source mirror seemed to be hazed over and The entrance window is a little dirty (can be cleaned easily). You will need a 68 pin SCSI connection to use this and a computer as neither was included when the item was purchased.

• ftir-8400s manual, shimadzu ftir 8400s user manual, shimadzu ftir 8400s manual, ftir-8400s manual, ftir 8400f manual pdf, ftir 8400f manual download, ftir 8400f manuals, ftir 8400f manual downloads, ftir 8400s manual.

IRPrestige-21, IRAffinity-1 and FTIR-8400S (IRsolution model) can be controlled from the FTIR-8400S. Shimadzu. Fourier Transform. Infrared Spectrophotometer. C103-E063F On-screen instructions for easy operation. Laptop PC control is available FTIR 8400s Catalogue - Free download as PDF File (.pdf), Text File (.txt) or read online for free. Shimadzu was the first company to offer dynamic alignment as a standard FTIR operators will love the quick-start function that prompts the user through every action. Keeler Vantage Plus Ophthalmoscope - Service Manual. FTIR-8400S is combined with the IRsolution - a 32 bit high performance FTIR software - to analyze your samples easily and securely. Dynamic alignment ensures reproducibility by maintaining optimum alignment Highly precise control of the moving mirror is required to stabilize the interferogram of the FTIR instrument. The FTIR-8400S includes the patented FJS system - very smooth and precise moving mirror unit - and the Dynamic Alignment system to optimize and stabilize the inter-ferometer unit. FTIR-8400S requires only a short stabilization time and is very secure. Dynamic Alignment (Patented) This System monitors the interferometer condition of He-Ne laser and compares it with that of optimized conditions. Any detected discrepancies by DSP system are corrected by automatic alignment of the piezo actuators at the fixed mirror. The Dynamic Alignment Advantage Optimal interferometer alignment is maintained automatically for continuous optimization and exceptional reproducibility. The Simplicity Advantage New FTIR operators will love the quick-start function that prompts the user through every action from setting scan parameters and acquiring the spectrum, to detecting peaks and printing. Notify me of new posts via email. Learn how your comment data is processed. To find out more, including how to control cookies, see here. If you continue browsing the site, you agree to the use of cookies on this website.

With state-of-the-art technology, the Shimadzu dynamic alignment system continuously maintains optimal alignment during data acquisition, ensuring consistently reproducible spectra without the need for tedious mechanical adjustments. FTIR-8400S is combined with the IRsolution - a 32 bit high performance FTIR software - to analyze your samples easily and securely. The Dynamic Alignment Advantage Optimal interferometer alignment is maintained automatically for continuous optimization and exceptional reproducibility. The Simplicity Advantage New FTIR operators will love the quick-start function that prompts the user through every action from setting scan parameters and acquiring the spectrum, to detecting peaks and printing.Dynamic alignment ensures reproducibility by maintaining optimum alignment Highly precise control of the moving mirror is required to stabilize the interferogram of the FTIR instrument. The FTIR-8400S includes the patented FJS system - very smooth and precise moving mirror unit - and the Dynamic Alignment system to optimize and stabilize the interferometer unit. FTIR-8400S requires only a short stabilization time and is very secure. He-Ne laser Piezo-actuator Signal amplifier Fixed mirror DSP Dynamic Alignment (Patented) This System monitors the interferometer condition of He- Ne laser and compares it with that of optimized conditions. Any detected discrepancies by DSP system are corrected by automatic alignment of the piezo actuators at the fixed mirror. The standard features include auto aperture, auto focusing, auto X-Y-Z stage movement and auto centering, as well as the transmittance and reflectance modes, and the on-board video-camera. Meet all your sampling requirements with such convenient options as grazing angle objectives, various ATR objectives and mapping software.

” Our location is: 826 Columbia Ave. Millville, NJ 08332. Any questions, please call (856) 300-5138 between 10:00PM and 7:00 PM EST with the item number and your user ID and we will be happy to assist you. Thanks!:). Discover everything Scribd has to offer, including books and audiobooks from major publishers. Start Free Trial Cancel anytime. Report this Document Download Now Save Save FTIR 8400s Catalogue For Later 0 ratings 0% found this document useful (0 votes) 647 views 2 pages FTIR 8400s Catalogue Uploaded by fierywin Description: Full description Save Save FTIR 8400s Catalogue For Later 0% 0% found this document useful, Mark this document as useful 0% 0% found this document not useful, Mark this document as not useful Embed Share Print Download Now Jump to Page You are on page 1 of 2 Search inside document Browse Books Site Directory Site Language: English Change Language English Change Language. We also share information about your use of our Website with our group companies, distributors and analytics partners.Please confirm that JavaScript is enabled in your browser. These are utilized in a wide range of structural analysis or non-destructive measurement applications, such as to qualify the location of defects on IC chips and other small parts in electronics, electrical, and semiconductor industries, to qualify pharmaceuticals based on the Japanese Pharmacopoeia, to identify vehicles from paint fragments left at crime scenes, or to verify starting materials on beads as a pre-synthesis study in combinatorial chemistry. This sensitivity combined with the LabSolutions IR Contaminant Analysis Macro enables easier, quicker and more accurate analysis of small samples. Labor-saving macros provide for a higher level of automation and improved work efficiency. Not for use in diagnostic procedures. Please contact us to check the availability of these products in your country.

The path length is selected according to concentration of the gas. Samples are clamped to the prism to ensure contact. For samples with high refractive indices, the Ge prism is suitable. For hard samples, the diamond prism is preferred. With the ATR correction available within the IRsolution software, ATR spectra is converted into a normal transmittance spectra. Another method for these sample types, involves scratching the surface of the sample and measuring with a diffuse reflectance accessory. A large contact area results in good sensitivity. The ZnSe prism is standard in most accessories. A Ge prisms is available for high refractive index samples. The measuring light is reflected through the prism 10 times. The sample is clamped firmly to the prism to ensure contact with an attached clamp and easily adjustable clamp pressure. This accessory is suitable for liquid, solids, powders, films, and a variety of other sample types. The ZnSe prism is standard. A Ge prism is available for high refractive index samples. The sample can be easily clamped to prism with the attached clamp with adjustable pressure. For hard samples, the Diamond MIRacle with diamond prism is available. Single Bounce ATR with a 2mm diameter diamond prism. This accessory is good for measuring hard samples that may damage other prism types. It is also suitable for liquid, solids, powders, films, and a variety of other sample types. The System I (High Pressure Device Type) allows the sample to contact the prism easily with the attached clamp and adjustable pressure. The System H (ViewIR Type) allows the sample to be visually observed while clamping. The powder of the sample on the emery paper is directly analyzed with a Diffuse Reflectance Accessory. 7 8 Versatility Versatility 2 For coating films on metals or resins For coatings, Reflectance is the measurement method is a choice. Selection of Specular Reflection or Reflection absorption method is dependent on the thickness of the coating sample.

Universal sampling with a diamond ATR Left Side: System I (High Pressure Device type) Right Side: System H(ViewIR type) Infrared spectrum of diphenhydramin hydrochloride(powder sample) measured with DuraSampllR2A (ATR-corrected spectrum) The DuraSampllR2A has two types of diamond prism, a diamond prism supported by a ZnSe lens and a diamond prism supported by a KRS-5 lens. The ZnSe type can measure up to around 600cm -1. On the other hand, the KRS-5 type can measure up to around 400cm -1. The infrared spectrum of diphenhydramin hydrochloride measured with the diamond prism supported by a KRS-5 lens is shown above. The KRS-5 type can give the infrared spectrum without noise up to 400cm -1. Plastics, rubbers, files and liquid samples can be measured with the DuraSampllR2A. 5 6 Versatility Versatility 2 For Liquid samples For measuring liquid samples, demountable or sealed liquid cells may be used. Additionally, the ATR (Attenuated Total Reflectance) accessories are also convenient. To measure liquids with ATR, sample preparation is as simple as dispensing the liquid onto the prism of the accessory. The ATR correction program in the IRsolution software converts the measured ATR spectrum into a normal transmittance measurement by correcting for depth penetration differences. The ZnSe prism is standard in most accessories. This accessory is suitable for liquid, solids, powders, films, and a variety of other sample types. The ZnSe prism is standard. A Ge prism is available for high refractive index samples. For powder samples For measuring powder samples, conventional KBr pellet methods may be used. The Diffuse reflectance method is also convenient and requires less sample preparation. In the Diffuse reflectance method, the sample is mixed with KBr powder and then measured, there is no need for making a pellet. Single Bounce ATR accessories may also be used for powder samples in some cases. For gases Various gas cells are available for gas sample measurement.

The IRsolution software has many functions ranging from Peak detection, spectral subtraction, Kubelka-Munk conversion and ATR correction functions to optional Spectrum searching and Quantitation. The results of data processing can be imported into Word Processing and Spread Sheet software applications. Pesk Picking Spectrum Search Quantitation Quantitation In addition to multi-point calibration curve methods, the IRsolution software offers MLR (Multi Linear Regression) and optional PLS (Partial Least Squares) analysis that is useful for NIR measurements. Spectrum Search The IRsolution software allows the creation of user libraries from acquired spectra, and spectral searching of user and commercial libraries. Report Generator Data is not useful unless you can get the results in the desired format. The IRsolution software includes a powerful report generator with customized layout features. With the Report Generator, you can create reusable print templates using any data including the spectrum, calibration curve, quantitation results and peak pick tables. You can set the thickness and color of the graph lines as well as the font size. Annotations may be attached on the graph to comment on the results. The print layout can be saved as a template file for later use, ensuring accurate repeat reporting. 11 12 Validation Reliability Reliability 1 FTIR-8400S has many features on hardware and within the software that improve reliability. Measurement conditions of the FTIR-8400S are constantly monitored and may be reported at anytime. IRsolution is complied to GLP and FDA 21 CFR Part 11. This validation program checks the performance of the FTIR-8400S using a polystyrene film and creates a report upon completion. History log of data processing. Software security by User name and Password By requiring a user name and password upon startup of the IRsolution software, security can enhanced by restricting the functions or methods for the particular user within a user group.

An administrator can restrict the functionality that is available within IRsolution to each particular user and can control all the user rights. The logon information is recorded into a log-file with the date, time and user name. Data Preservation, Operation Logging, Audit-trail of the instrument Spectra that are obtained by the IRsolution software are stored in a Container file that includes with scan parameters, background and the original interferogram. When a data manipulation is performed, the processed data is added to the file along with date and time of processing, user name and the manipulation method. The original data is preserved - not overwritten. This file can be displayed and is write-protected by the IRsolution software for security. The electronic signature is also supported for FDA 21 CFR Part 11 compliance.Operation Log 12 13 Hardware Reliability Reliability 2 The Interferometer is one of the most important parts of the FTIR. For accurate data collection, the interferometer must scan with high precision. The FTIR-8400S includes the Patented FJS system which scans the moving mirror with a smooth and stable mechanism. The optimization and stabilization of the FTIR-8400S interferometer by Dynamic Alignment system ensures consistent and repeatable results. Since the beam splitter within the interferometer is susceptible to moisture, the optical system of the FTIR-8400S is sealed and desiccated. Protection of the Interferometer and Atmosphere Correction The Interferometer is one of the most important parts of the FTIR. The FTIR-8400S has 3 features to stabilize the interferometer and to protect the beam splitter. 1. Sealed optical system to create closed environment 2. Anti Humidity Beam Splitter coating to provide extra protection 3.

Samples are placed on the top of the accessory with the measurement side down. The specular reflectance spectra can convert into a transmittance spectra with Kramers-Kronig conversion in the IRsolution software. Analysis of nm thick thin films is possible. The optional GPR-8000 polarizer allows for higher sensitivity measurement. When a polarized light beam is incident on a metal substrate, the phase of the light is changed. In vertical polarization, the vectors of the polarized light are opposite to each other, and hence no stationary waves are produced. In parallel polarization, the the vectors of the polarized light meet at the point to produce stationary waves, which enhances the sensitivity of the measurement. Accessory for automated analysis Various automation accessories, are available to provide efficient analysis of large numbers of samples. The holder is designed for 13mm diameter KBr pellets and optional film-holder or cell plates for Nujol mulls are also available. The ASC-8000T can be easily controlled by the IRsolution software. The DRS-8010ASC accepts up to 24 samples. The DRS-8010ASC can be easily controlled by IRsolution software. Infrared spectrum of lactose Infrared spectrum of lactose measured with the DRS-8010ASC automatic diffuse reflectance accessory (Kubelka-Munk concerted spectrum) 8 9 Versatility 3 Space Efficient Laptop PC Control A unique laptop PC rack option (note1) reduces the system footprint to just 630mm (W) by 592mm (D), and the height to only 530mm. Process your data anywhere with this portable PC option. (note1) Rack accommodates 13.3 inch laptop PC. (note2) Microscope-equipped systems require desktop PC. (note3) Special SCSI interface for laptop PCs is required. In either case, procedures can be simplified by standard Easy-Scan program, all procedures including the setting of measurement parameters, analysis of the sample, data processing, saving, and printing the results are performed with one click operation.

The IRsolution software is equipped with an Easy-Scan program. This macro program takes the user step by step through the entire analysis from spectrum measurement, peak detection, printout and saving of the result data. On screen instructions guide the operator ever step of the way. This feature allows for a decrease in the learning curve for operating the IRsolution and the FTIR-8400S. Scan Parameter Setting BKG Measurement Peak Detection 9 10 Software IRsolution IRsolution software provides windows based 32bit software control for the FTIR-8400S. With IRsolution, operations for FTIR analysis can be performed easily and quickly using dedicated analysis screens Spectrum measurement Data display and comparison to other spectra Data processing, quantitation and spectral searching Report Generation As the operation progresses, the IRsolution software automatically advances into the optimum mode. Optional software such as PLS quantitation modules are available for increased versatility. You can quickly access the many useful functions of IRsolution by customizing the User Interface of software. Measurement and Status Monitor In the measurement menu of IRsolution, all measurement start buttons and dialogs to set the analysis parameters are integrated for easy operation. All measurement parameters are arranged into four dialog screens that are easily viewed. One click operation will start the analysis. During measurement, a real time spectrum is displayed on screen. The hardware settings are displayed on the status monitor screen. Status Monitor View Mode After the data is acquired, you can use the View Mode to zoom in on certain areas or compare with other spectra. 10 11 Data Manipulation, Quantitation and Spectrum Search After the data acquisition has been completed, you can extract a variety of specific information from measured spectrum.

Desiccated interferometer to remove moisture by Desiccants He-Ne laser Moving mirror Fixed mirror BS Colimator mirror Light sourse The Atmosphere Correction Function easily compensates for the influences of water vapor and carbon dioxide on your data. You can easily get beautiful spectra with the FTIR-8400S even if the sample has peaks which are overlap with water vapor around cm -1 or cm -1. Laser detector Sealing case Sample position KRS-5 window Condensing mirror Detector Elimination of influences of CO2 and H2O by Atmosphere Correction Blue: Spectrum Before Atmosphere Correction Red: Spectrum After Atmosphere Correction 13 14 Optional Software Optional Software Wide varieties of optional software to enhance IRsolution capabilities Powerful 32-bit Windows based software - IRsolution - has various optional software modules to enhance its performance: IRsolution Agent Mapping software - AIM-MAP (for the AIM-8800 Microscope) PLS quantitation software Curvefitting (Peak split) software PharmaReport Program note) Macro Platform IRsolution includes a wide selection of data manipulation operations which include: spectral subtraction and Kubelka-Munk conversion; Variety of Quantitation operations - Multi-point Method and Multiple Linear Regression (MLR) method; as well as Spectral search functions. The optional software for IRsolution expands the application capabilities of IRPrestige-21.IRsolution Agent software consists of a database function and a data registration function from IRsolution to IRsolution Agent, as well as electronic signature capabilities. Mapping conditions such as Mapping area, Scan intervals, Background position and etc.You can operate the AIM microscope and AIM-MAP through simple point and click operations. AIM-MAP has 3 types of mapping modes - Area mapping, Line mapping and Random mapping. IRsolution mapping has various data manipulation functions such as extracting a spectrum from mapped data or reprocessing functional-group mapping.

The mapped data can be shown as 3D bird's-eye view, counter plot or spectral overlay mode. IRsolution has PLS I and PLS II method for PLS quantitation. Curve fitting (Peak split) software separates IR bands to individual component peaks. This software is good for many applications such as analysis of peak with hydrogen bond influences, and analysis of hidden peaks overlapped with other peaks. Component peaks and a synthesized peak are displayed to evaluate the separation. Curve fitting (Peak split) result of peak ( cm -1 ) of ABS resin spectrum. The program conducts the following calculations and comparisons: Calculates the discrepancy in the peak wavenumbers of the sample being checked and the reference previously registered. Calculates the peak intensity ratio at several designated evaluation peaks for comparison between the sample and reference. In addition to the functions above, it is also possible to detect and print the previously designated peaks only, and to print out the spectra of the measured sample and the reference side by side. Dimensions With desktop PC (Unit: mm) With laptop PC using rack (Unit: mm) (note5) Dimensions for PC and Printer depend on models. JQA-0376 Founded in 1875, Shimadzu Corporation, a leader in the development of advanced technologies, has a distinguished history of innovation built on the foundation of contributing to society through science and technology. We maintain a global network of sales, service, technical support and applications centers on six continents, and have established long-term relationships with a host of highly trained distributors located in over 100 countries. For information about Shimadzu, and to contact your local office, please visit our Web site at SHIMADZU CORPORATION. International Marketing Division 3. Kanda-Nishikicho 1-chome, Chiyoda-ku, Tokyo, Japan Phone: 81(3) Fax. 81(3) URL The contents of this brochure are subject to change without notice.

Printed in Japan ATD I N T R O D U C T I O N FT-IR stands for Fourier Transform InfraRed, the preferred method of infrared spectroscopy. In infrared spectroscopy, Dispersive IR Spectroscopy This will enable PC control. Push the F4 Button 2) Log into the UV-VIS software with your username and password. 3) After Joe Van Gompel, PhD The electromagnetic The haze-gard i quantifies the visual perception All information contained in this publication is believed to be correct and complete. Thermo Electron Corporation shall not be liable Presentation Materials Richard Koops VSL Dutch Metrology Institute Delft You will need these skills to RotatIR Automated Rotating Sample Stage Accessory All information contained in this publication is believed No Turn on the Systems PC Switch Turn on Main Power Switch Yes Turn on the laser main power switch and turn Size and Edge Detection APPLICATIONS The EE-SX199 detects the absence or presence of labels (see Bar Code Printer illustration at right). Alluxa Engineering Staff Alluxa Engineering Staff December 2012 Specifying Advanced Plasma Deposited Hard Coated Optical Bandpass and Dichroic Filters. Introduction The SpectraTec II Ultraviolet-Visible MAS 40 Mini-Array Spectrometer.These advances in coating technology From cell phone cameras to space telescopes, driverless Plymouth, UK 15 17 February 2011.Claude Bernard (1813-1878) OBJECTIVES To examine the The precision and accuracy of a This CNC controlled machine features fast, simple programming coupled with high operating speeds to meet today s varied production requirements. Designed for When you specify a high resolution, Closed books, notes, etc. No electronic device except a calculator. No electronic device except a calculator. NAME: (all questions with equal weight) 1.

If the distance between two point charges is tripled, the This journal is The Royal Society of Chemistry 2014 Supporting Information Prussian blue nanoparticles for laser-induced photothermal therapy of In this lab you will use a spectrophotometer To use this website, you must agree to our Privacy Policy, including cookie policy.

ftk 4 manual

For more details, see Testing the Memory. Figure 2-10 Memory test Generally, the test process takes several minutes to several hours. For more details, see Testing a Hard Disk. Figure 2-11 Hard disk test screen For more details, see Erasing Hard Disks. Enter 8 to collect logs as shown in Figure 2-12. For more details, see Collecting Logs. Figure 2-12 Collecting logs For more details, see Creating a Bootable USB Flash Drive. Enter 10 to save the system run log to a USB flash drive. For more details, see Saving Log Files to a USB Flash Drive. Enter S or s to save the log to a remote server. For more details, see Saving Log Files to a Remote Server. Enter C or c to switch to the Linux command line mode. For more details, see Entering and Exiting the CLI. Enter R or r to restart the system. Enter P or p to power off the system. Then, restart the browser. Discover everything Scribd has to offer, including books and audiobooks from major publishers. Report this Document Download Now Save Save FTK 1.80 Manual For Later 100% (1) 100% found this document useful (1 vote) 4K views 365 pages FTK 1.80 Manual Uploaded by Adam Smith Description: Full description Save Save FTK 1.80 Manual For Later 100% 100% found this document useful, Mark this document as useful 0% 0% found this document not useful, Mark this document as not useful Embed Share Print Download Now Jump to Page You are on page 1 of 365 Search inside document Browse Books Site Directory Site Language: English Change Language English Change Language. Apologies for the inconvenience! This guide assumes that a case including all digital materials related to the collection has already been created. If that is not true, please contact Jen or Pablo. From time tracker, select your name and add the MC number for the collection you will be processing. On FTK, add your designated username and password to gain access to your collections.

• ftk 4 manual, ftk 4 manual pdf, ftk 4 manual download, ftk 4 manual free, ftk 4 manual software.

All trademarks are property of their respective owners in the US and other countries. If you believe your item has been removed by mistake, please contact Steam Support. Please see the instructions page for reasons why this item might not work within For The King. All trademarks are property of their respective owners in the US and other countries. Some geospatial data on this website is provided by geonames.org. Restart the server when using FTK. The FTK uses a fixed serial port to output information. The serial port is set to COM1 or 3F8 on the BIOS. See Figure 2-1 or Figure 2-2. Figure 2-1 Serial port setting on the BIOS (1) For details, see Mounting FTK Using the Remote Virtual Console. The FusionServer Tools Toolkit interface is displayed, as shown in Figure 2-3. After you select Diagnose, the tool automatically displays the configuration information and performs a hardware health status diagnosis, and displays the menu, as shown in Figure 2-4. Diagnose and Toolkit provide the same menu and functions, except that the memory test provided in Diagnose provides memory protection mechanism. Toolkit: provides common maintenance tools. If you select Toolkit and press Enter, the function menu is displayed, as shown in Figure 2-5. Boot from hard disk: boots the system from a hard drive. The Toolkit menu is displayed, as shown in Figure 2-5. You can also run the ftk command on the command line interface (CLI) to open the main menu. The tool displays the configuration information and performs a hardware diagnosis. For more details, see Automatic Diagnosis. Enter 2 to display hardware information. Information similar to Figure 2-6 is displayed. For more details, see Displaying Hardware Information. Figure 2-6 Hardware information Information similar to Figure 2-7 and Figure 2-8 is displayed. For more details, see Inspecting Hardware. Figure 2-7 Hardware inspection For more details, see Testing a CPU. You can specify the test time. A CPU test takes about at least 5 minutes.

comii Forensic Toolkit User Guide FTK features powerful file filtering and searchfunctionality and is recognized as the leading forensic tool fore-mail analysis.This chapter contains the following sections: “Audience” on page 2 “Handling Evidence” on page 2 “Role of Forensic Toolkit” on page 3 “Other AccessData Products” on page 3 1 This type of evidence is fragile and can easily, even inadvertently, be altered, destroyed, or rendered inadmissible as evidence. Computer evidence must be properly obtained, preserved, and analyzed to be accepted as reliable and valid in a court of law. To preserve the integrity of case evidence, forensic investigators do not work on the original files themselves. Instead, they create an exact replica of the files and work on this image to ensure that the original files remain intact. To verify the files they are working on have not been altered, investigators can compare a hash of the original files at the time they were seized with a hash of the imaged files used in the investigation. Hashing provides mathematical validation that a forensic image exactly matches the contents of the original computer. Another important legal element in computer forensics is the continuity, or chain of custody, of computer evidence. The2 Forensic Toolkit User Guide Forensic investigators must be able to account for all that has happened to the evidence between its point of acquisition or seizure and its eventual appearance in court. There are many cases in which personnel trained in information technology have made incriminating computer evidence legally inadmissible because of their reckless or ill- conceived examinations. Only properly trained computer forensics specialists should obtain and examine computer evidence.Role of Forensic Toolkit When you acquire computer evidence, you can use FTK ImagerTM to create an image of the source drives or files.

From the available list of collections, double click on the collection you will be processing. While keeping the shift key down, click the end key to select all files in that category. From the label menu, select the corresponding label for that category. 16. Make sure that all files have been labeled by scrolling down through the file list and check that the label name appears on the label column. You can create a complex hierarchy using empty bookmarks. This is recommended for Collections, Series, and Sub-series, for folder names it is better to use a slightly different method (indicated below). Finally, select the bookmark that will house the file(s). If you continue browsing the site, you agree to the use of cookies on this website. See our User Agreement and Privacy Policy.If you continue browsing the site, you agree to the use of cookies on this website. See our Privacy Policy and User Agreement for details.If you wish to opt out, please close your SlideShare account. Learn more. You can change your ad preferences anytime. Check out, please ? www.HelpWriting.net ?This awesome company. After I was continuously complaining to my family and friends about the ordeals of student life. They wrote my entire research paper for me, and it turned out brilliantly. I highly recommend this service to anyone in my shoes. ? www.WritePaper.info ?.It depends on the individual skill set also. You can get help from research paper writing. Check out, please ? www.HelpWriting.net ?Save so as not to loseFurther, AccessData Corp.Further, AccessData Corp. All rights reserved. No part of this publication may be reproduced,photocopied, stored on a retrieval system, or transmitted without the express written consent ofthe publisher.Version 1.80.0May 22, 2008AccessData Corp.384 South 400 WestLindon, Utah 84042U.S.A.www.accessdata.

Hardware acquisition tools duplicate disk drives or allow read- only mode access to a hard drive. For more information about hardware tools, see “Industry and Third-Party Contacts” on page 321. Software acquisition tools create a forensically sound image that makes no changes to the data or information on the suspect hard drive. The forensic image must be identical in every way to the original. As a rule, no changes to the evidence should be made. FTK Imager is a software acquisition tool. It can be used to quickly preview evidence and, if the evidence warrants further investigation, create a forensically sound image of the disk. To prevent against accidental or intentional manipulation of evidence, FTK Imager makes a bit-by-bit duplicate image of the media. The forensic image is identical in every way to the original, including file slack and unallocated space or free space. For information about file slack and unallocated space, see the Glossary on page 343. FTK Overview 7 Hash values are used to verify file integrity and identify duplicate and known files. (Known files are standard system files that can be ignored in your investigation as well as known illicit or dangerous files.) Two hash functions are available in FTK and FTK Imager: Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1). By default, FTK creates MD5 hashes. The hashing options are selected automatically by FTK based on the KFF databases that are available. For more information about KFF, see “Known File Filter” on page 9. The following graphic shows a sample file with a list of MD5 and SHA-1 hashes. Typically, you hash individual files to compare the results with a known database of hashes, such as KFF. However, you can also hash multiple files or an image to verify that the working copy is identical to the original. You can create hashes with FTK Imager or FTK. For information on creating hashes with FTK, see “Selecting Evidence Processes” on page 65.

You can also create a hash of the original image that you can later use as a benchmark to prove the validity of your case evidence. FTK Imager verifies that the image hash and the drive hash match when the image is created. After you create the image and hash the data, you can then use FTK to perform a complete and thorough computer forensic examination and create a report of your findings. For a big-picture view of FTK, see“FTK Overview” on page 5.Other AccessData Products In addition to FTK and FTK Imager, AccessData offers other industry-leading products. Preface 3 AccessData has multiple tools available for password recovery: Password Recovery ToolkitTM (PRTKTM) has a wide variety of individual password-breaking modules that can help you recover lost passwords. For more information about PRTK, the AccessData Website ( ). Rather than using a single machine, DNA uses machines across the network or across the world to conduct key space and dictionary attacks. For more information about DNA, the AccessData Website ( ).FTK 2.0 The most comprehensive AccessData product for forensic investigation is FTK 2.0. It includes all the PRTK recovery modules, a 50-client license for DNA, and a one-year upgrade subscription for all of the included products. Any products and upgrades purchased in that year do not expire. For more information about FTK 2.0, the AccessData Website ( ).4 Forensic Toolkit User Guide The chapter contains the following sections: “The Big Picture” on page 6 “Acquiring and Preserving the Evidence” on page 7 “Analyzing the Evidence” on page 8 “Presenting the Evidence” on page 10 5 Acquire and Preserve the Evidence Workstation Target Analyze the Case Prepare a Report Case Report The concepts behind each of these steps are discussed in the following sections.6 Forensic Toolkit User Guide There are two ways to achieve this: by creating an image of the suspect drive using hardware devices or by using software applications.

System policies and procedures Check with your system administrator about any specific policies and procedures that may exist.14 Forensic Toolkit User Guide The installation is divided into three parts: Install the Forensic Toolkit: FTK 1.70.0 and later will install in locations separate from FTK 1.6 or earlier. Your older versions of FTK and their cases will not be affected by installing FTK 1.70. Warning: FTK 1.70.0 has an upgraded database, increasing the limit on how many items a case can contain. This enhancement, however, renders FTK 1.70.0 incompatible with earlier versions. Cases processed in earlier versions of FTK cannot be opened in FTK 1.70.0, and cases processed in 1.70.0 cannot be opened in earlier FTK versions. FTK Imager is now a separate installation. Install the Known File Filter Library: Installs the Known File Filter (KFF) database, a utility that compares file hashes in your case against a database of hashes for known system and program files as well as known illicit and contraband files. To preserve work done on earlier versions of FTK, your 1.70.0 KFF will be installed in the 1.70.0 directory without overwriting any previously installed KFFs. To economize disk space, you may choose to manually delete older versions of your KFF. To point any version of FTK to the new KFF, go to the Tools menu, then type in the path in the Preferences dialog. For additional information about KFF, see “Known File Filter” on page 9. Launch Dongle Driver Setup: Installs the driver for either the USB or parallel port dongle. The dongle is required to use FTK and it should be stored in a secure location when not in use. Each part can be independently installed, although FTK and the dongle driver must be installed for FTK to work properly. If you want to eliminate ignorable and duplicate files, and be Installing the Forensic Toolkit 15 For troubleshooting information on the FTK install, see “Troubleshooting” on page 275.

Basic Install from CD The following sections review installing FTK, the dongle drivers, and KFF from CD.Installing FTK from CD To install FTK from CD: 1 Insert the CD into the CD-ROM drive and click Install the Forensic Toolkit. If auto-run is not enabled, select Start, and then Run. Browse to the CD-ROM drive and select Autorun.exe. 2 Click Next on the Welcome screen. 3 Select I Accept the Terms of the License Agreement and then click Next. 4 Designate the program directory by doing one of the following: To accept the default directory, click Next. The default directory is c:Program FilesAccessDataAccessData Forensic Toolkit. To specify a different directory, click Browse, select the location, and click OK. 5 Click Next. 6 Check the box to run FTK if you want it to automatically start after you complete the installation. If you check the box to run FTK but haven’t installed the dongle drivers, you will receive an error message and FTK will not start. If you run FTK but haven’t installed the KFF database, you will receive an error message at the end of the installation16 Forensic Toolkit User Guide You can install the dongle drivers and KFF from the CD. For installation instructions, see “Installing the Dongle Driver from CD” on page 17 and “Installing KFF from CD” on page 18. 7 Check the box to run LicenseManager if you want it to automatically check for updates. LicenseManager automatically checks the AccessData Website for software updates. For more information on LicenseManager, see “Managing Licenses” on page 263. If LicenseManager is not installed, a warning is displayed. See “Installing LicenseManager from CD” on page 23 or “Installing LicenseManager from Downloadable Files” on page 26. 8 Click Finish.Installing the Dongle Driver from CD Installing the KEYLOK (green) Dongle Driver 1 Insert the CD into the CD-ROM drive and click Launch Dongle Driver Setup. If auto-run is not enabled, select Start, and then Run. Browse to the CD-ROM drive and select Autorun.exe.

8 Forensic Toolkit User Guide The purpose of KFF is to eliminate ignorable files (such as known system and program files) or to alert you to known illicit or dangerous files. It also checks for duplicate files. Files which contain other files, such as Zip and e-mail files with attachments, are called container files. When KFF identifies a container file as ignorable, FTK does not extract its component files. When KFF is used, the evidence is separated into ignored files (such as system files) and evidence that you continue to examine. KFF includes the HashKeeper database, which is updated periodically and is available for download on the FTK update page ( ). For information on defining the location of the KFF database, see “KFF Database Location” on page 259.Searching With FTK, you can conduct a live search or an indexed search. A live search is a time-consuming process involving an item-by- item comparison with the search term. Live searches allow you to search non-alphanumeric characters and perform regular expression searches. Note: Regular expressions are mathematical statements that describe a data pattern such as a credit card or social security number. Regular expression searches allow you to find data items that conform to the pattern described by the expression. FTK provides several pre-defined regular expressions such as U.S. phone number, U.K. phone number, credit card number, social security number, and IP address. The indexed search uses the index file to find a search term. The index file contains all discrete words or number strings found in both the allocated and unallocated space in the case evidence. FTK Overview 9 For more information on searching, see “Searching a Case” on page 149.Presenting the Evidence FTK presents computer evidence by creating a case report and case log to document the evidence and investigation results. FTK uses the Report Wizard to create and modify reports.

In the report, you can add bookmarks (information you selected during the examination), customize graphics references, select file listings, and include supplementary files and the case log. You can also export selected files with the report, such as bookmarked files and flagged graphics, so they are available with the report. The report is generated in HTML. The case log assists in documenting and logging activities during the investigation and analysis of a case. This information can be used as part of a report or to identify what has occurred if you are assigned to an investigation in progress. The case log is created automatically by the FTK and is called ftk.log. For information about creating a report, see “Working with Reports” on page 221.10 Forensic Toolkit User Guide The chapter is divided into the following sections: “Supported File Systems and Image Formats” on page 13 “System Preparation” on page 14 “Basic Installation” on page 15 “Upgrade Instructions” on page 27 “Uninstalling” on page 30 11 A good understanding of the workstation and its configured devices will help ensure that FTK runs at its best. Consider the following: Role of the workstation Determine if it will be used as a regular user workstation, a forensic analysis workstation, or a password recovery workstation. Access policy Identify where the workstation will be located, who can access the information, and when the cases can be worked on. Hardware and software requirements For the hardware and software requirements, see “System Requirements” on page 12. Application relationships Verify that the applications can work simultaneously. Do not run so many applications that you compromise overall performance. Network and Internet issues Determine if the workstation should be connected to a network or the Internet. Under normal circumstances, the forensic analysis workstation will not be connected to the Internet to avoid the possible tainting of evidence.

2 Click Next to install the driver. 3 If you have a USB dongle, verify that it is not plugged in. If you have a parallel port dongle, verify that it is plugged in. Click Next after meeting the above conditions. 4 Designate the dongle driver directory by doing one of the following: To accept the default directory, click Next. The default directory is c:Program FilesAccessDataDongle Driver. To specify a different directory, click Browse, select the location, and click OK. Installing the Forensic Toolkit 17 Click Install CodeMeter Software to launch the CodeMeter installation wizard, as displayed in the following figure. 2 Follow the directions for installation, accepting all defaults, and click Finish to complete the installation.Installing KFF from CD To install KFF from CD: 1 Insert the CD into the CD-ROM drive and click Install the Known File Filter Library. If auto-run is not enabled, select Start, and then Run. Browse to the CD-ROM drive and select Autorun.exe. 2 Click Next on the Welcome screen. 3 Select I Accept the Terms of the License Agreement and then click Next.18 Forensic Toolkit User Guide The default directory is c:Program FilesAccessDataAccessData Forensic ToolkitProgram. To specify a different directory, click Browse, select the location, and click OK. Important: If you install KFF to another directory, you must indicate the new location in FTK Preferences. For more information, see “KFF Database Location” on page 259. 5 Click Next. 6 Click Finish.Basic Install from Downloadable Files FTK downloadable files are available from the AccessData Website ( ). To download the FTK program files: 1 Go to the AccessData downloads page. 2 Under Forensic Toolkit, click Updates. 3 Download the program files you would like to install. If this is the first time you have installed FTK, download both FTK and the dongle driver.

If you want to eliminate ignorable and duplicate files, and be alerted of known illicit or contraband files, you also need to download the KFF database.The default directory is c:Program FilesAccessDataAccessData Forensic Toolkit. To specify a different directory, click Browse, select the location, and click OK. 8 Click Next. 9 Check the box to run FTK if you want it to automatically start after you complete the installation. If you check the box to run FTK but haven’t installed the dongle drivers, you will receive an error message and FTK will not start. If you run FTK but haven’t installed the KFF database, you will receive an error message at the end of the installation saying that the KFF Hash Library is not found and certain features will be disabled. You can install the dongle drivers and KFF from the downloadable files. For installation instructions, see “Installing the Dongle Drivers from Downloadable Files” on page 21. 10 Check the box to run LicenseManager if you want it to automatically check for updates.20 Forensic Toolkit User Guide For more information on LicenseManager, see “Managing Licenses” on page 263. If LicenseManager is not installed, a warning is displayed. See “Installing LicenseManager from CD” on page 23 or “Installing LicenseManager from Downloadable Files” on page 26. 11 Click Finish.Installing the Dongle Drivers from Downloadable Files Installing the KEYLOK (green) Dongle Driver To install the dongle drivers from downloadable files: 1 On the Forensic Toolkit Download page, click the dongle drivers install. 2 Save the dongle install file (dongle.exe) to a temporary directory on your drive. 3 To launch the install program, go to the temporary directory and double-click the dongle install file (dongle.exe). 4 Click Install. 5 Click Next to install the driver. 6 If you have a USB dongle, verify that it is not plugged in. If you have a parallel port dongle, verify that it is plugged in.

7 Designate the dongle driver directory by doing one of the following: To accept the default directory, click Next. The default directory is c:Program FilesAccessDataDongle Driver. To specify a different directory, click Browse, select the location, and click OK. 8 Click Next. 9 If you have a USB dongle, plug it in. 10 Click Finish. Installing the Forensic Toolkit 21 Click Install CodeMeter Software to launch the CodeMeter installation wizard, as displayed in the following figure.CodeMeter Installation Wizard 5 Follow the directions for installation, accepting all defaults, and click Finish to complete the installation.Installing KFF from Downloadable Files To install KFF from downloadable files: 1 On the Forensic Toolkit Download page, click KFFInstall.exe. 2 Save the KFF install file (kffinstall.exe) to a temporary directory on your drive.22 Forensic Toolkit User Guide The default directory is c:Program FilesAccessDataAccessData Forensic ToolkitProgram. To specify a different directory, click Browse, select the location, and click OK. Important: If you install KFF to another directory, you must indicate the new location in FTK Preferences. For more information, see “KFF Database Location” on page 259. 7 Click Next, then click Finish.Installing LicenseManager from CD LicenseManager lets you manage product and license subscriptions using a dongle or dongle packet file. For more information, see “Using LicenseManager” on page 55. To install LicenseManager: 1 Insert the CD into the CD-ROM drive and click Install LicenseManager. If auto-run is not enabled, select Start, and then Run. Browse to the CD-ROM drive and select Autorun.exe. Installing the Forensic Toolkit 23 The default directory is C:Program FilesAccessDataAccessData LicenseManager. To specify a different location, click Browse, select the location, click OK, and the click Next.5 If you want to launch LicenseManager after completing the installation, select Run LicenseManager.

Installing the Forensic Toolkit 25 You can also start LicenseManager in FTK, by clicking Help, and then Launch LicenseManager.Installing LicenseManager from Downloadable Files LicenseManager lets you manage product and license subscriptions using a dongle or dongle packet file. For more information, see “Using LicenseManager” on page 55. To install LicenseManager: 1 Go to the AccessData download page ( ). 2 On the download page, click LicenseManager. 3 Save the dongle installation file (LicenseManager.exe) to a temporary directory on your drive. 4 To launch the installation program, go to the temporary directory and double-click the dongle installation file (LicenseManager.exe). 5 Click Install.26 Forensic Toolkit User Guide For example, you can upgrade to a newer version of FTK without upgrading the KFF database. Important: You do not need to upgrade the dongle drivers unless notified by AccessData. You can upgrade the version of FTK from a CD or from downloadable files available on the AccessData Website ( ). To be notified via e-mail when FTK upgrades are available, go to the Update Notification page on the AccessData Website ( ). For troubleshooting information on upgrading FTK, see “Troubleshooting” on page 275.Upgrading from CD Typically you will upgrade from downloadable files. If you want to upgrade from CD, contact AccessData. For contact information, see “Technical Support” on page 341.Upgrading FTK from CD To upgrade FTK from CD: 1 Insert the CD into the CD-ROM drive and click Install the Forensic Toolkit. If auto-run is not enabled, select Start, and then Run. Browse to the CD-ROM drive and select Autorun.exe. 2 Select Install the Newer Version and click Next. 3 Check the box to run FTK if you want it to automatically start after you complete the installation. 4 Check the box to run LicenseManager if you want it to automatically check for updates.

Installing the Forensic Toolkit 27 For more information on LicenseManager, see “Managing Licenses” on page 263. If LicenseManager is not installed, a warning is displayed. See “Installing LicenseManager from CD” on page 23 or “Installing LicenseManager from Downloadable Files” on page 26. 5 Click Finish.Upgrading KFF from CD If you have added your own hashes to the KFF database, see “Upgrading a Customized KFF” on page 30 for instructions on how to upgrade the KFF database without overwriting the hashes you have added. If you have not customized the KFF library, simply re-install the KFF from CD. To upgrade a basic KFF from CD: 1 Insert the CD into the CD-ROM drive and click Install the Known File Filter Library. 2 Select Replace My KFF with This Version and click Next. 3 Click Finish.Upgrading from Downloadable Files FTK downloadable files are available from the AccessData Website ( ). To download the FTK program files: 1 Go to the AccessData downloads page. 2 Under Forensic Toolkit, click Updates. 3 Download the program files you would like to install.Upgrading FTK from Downloadable Files To upgrade FTK from downloadable files:28 Forensic Toolkit User Guide Note: Your custom column settings and filters are not overwritten. 6 In the install program, select Install the Newer Version and click Next. 7 Check the box to run FTK if you want it to automatically start after you complete the installation. 8 Check the box to run LicenseManager if you want it to automatically check for updates. LicenseManager automatically checks the AccessData Website for software updates. For more information on LicenseManager, see “Managing Licenses” on page 263. If LicenseManager is not installed, a warning is displayed. See “Installing LicenseManager from CD” on page 23 or “Installing LicenseManager from Downloadable Files” on page 26. 9 Click Finish.