Digital Forensic News & Events
Bringing investigators digital forensics and cybersecurity related news from around the world. #AllinForensics


 

Back to News

How-To Image on a Boot and Live Scan

Posted by Richard T. Frawley on January 6, 2020
Richard T. Frawley
Find me on:

Our newest How-To video will cover how to image from either the Desktop tool or the USB device (Collection Key) on a Boot and Live Scan. 

On the Desktop Version of our tool you can get to imaging two ways; immediately after a scan stops or is stopped, and from Image Attached Devices on the home screen.

There are three mandatory items to be selected: Source, Destination, and Image Name.  Once a Source is selected more optional details can be added, including the Image Format (EWF_E01), which is selected by default.  You can also choose to verify the image after it is created. 

Clicking the Image button will start the imaging process. A progress bar will be displayed and a notification shown when the imaging process has been completed. If the image is to be verified this will occur after the imaging process and a new progress bar will be displayed.

Verification results will be found in an accompanying .log file.

If you have the PRO version of our tools and want to back up a mobile device, select Add Phone from the Image Attached Devices. Even if the phone has already been recognized, use the Add Phone option to verify all steps have been covered.

Select the type of the phone you wish to add and follow the on-screen instructions to add your device. When the mobile device has been successfully added it will appear in the Source combo box.

Choose a destination and Back Up Name (Default is Phone/OS/SN/Datetime), and Select Image to commence back-up. On an iOS device you will be prompted before and after the backup to enter the device password so that encryption can be used to collect more data.

Imaging

On a Live or Boot Scan you can get to imaging immediately after a scan stops or is stopped, and from the Image Computer on the home screen.

Select the device you want to image. You are required to connect the destination drive (the drive the image will be saved to). This prevents any writing to other suspect (source) devices. Once the destination drive is connected the information fields are available to be filled in. 

Clicking the Image button will start the imaging process. A progress bar will be displayed and a notification will be shown when the imaging process has been completed. If the image is to be verified this will occur after the imaging process and a new progress bar will be displayed.

Verification results will be found in an accompanying .log file.

 

How to Boot Scan a Surface Pro

 

Topics: Digital Forensics, Digital Evidence Investigator, Triage-G2, Triage-Investigator, Computer Forensics, Forensic Software, Forensic Analysis, How To Video, Mobile Device Investigator, Cyber Forensics, Digital Evidence

Get Triage & Digital Forensic News (once a month)

Posts by Tag

See all

Recent Posts

CustomButton
  • READY TO ACCELERATE YOUR DIGITAL INVESTIGATIONS?