FTK Imager File Lis...
 
Notifications
Clear all

FTK Imager File Listing

5 Posts
4 Users
0 Likes
4,318 Views
4n6art
(@4n6art)
Posts: 208
Reputable Member
Topic starter
 

Hello All

In FTK Imager, there is a way *during the imaging* to ask FTKI to create a file listing of the files - which it does in CSV format.

I have an e01 that was created by someone else. The original drive is not available. Is there a way to open the e01 in FTK Imager and have that file listing CSV created? I don't want to mount the image and do a temporary image of the mounted drive just to get the CSV listing unless I absolutely have to.

Or… is there another way for me to get a similar file listing of the files within the e01?

Appreciate any help.
-=Art=-

(haven't checked the AD forums…yet… I figured there would be more eyes here ) )

 
Posted : 04/12/2013 11:36 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

Just to clarify are you seeking a list of the individual E01 files that are created at the time which includes the MD5 hash results?

OR

Are you hoping for a list of the directory structure, ie all the files and folders that would be visible if you mounted the image and browsed it with Windows explorer?

 
Posted : 04/12/2013 12:23 pm
(@francesco)
Posts: 79
Trusted Member
 

Just add the E01 as evidence and you can right-click it to export a file listing.

 
Posted : 04/12/2013 1:54 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

I think she is asking for the "Create directory listings of all files in the image after they are created" list.

This option is on the same screen where the image destination is selected.
The CSV file should be at the same location where the image file is placed.

 
Posted : 04/12/2013 6:55 pm
4n6art
(@4n6art)
Posts: 208
Reputable Member
Topic starter
 

Duh!! wow… how did I miss that. That's what it was… RightClick and choose "Create Directory Listing"

Thank you!

Yes I was looking for that Directory listing. I didn't want the hash values - just a list of files, locations, sizes and dates. Thanks all!

("Picked the wrong day to quit sniffing glue" Lloyd Bridges… Airplane ) )

-=Art=-

Just add the E01 as evidence and you can right-click it to export a file listing.

 
Posted : 04/12/2013 9:58 pm
Share: