FTK Imager - Why do...
 
Notifications
Clear all

FTK Imager - Why do I have a dozen of file type "002", "003"

4 Posts
3 Users
0 Likes
1,076 Views
(@gwekkeo)
Posts: 1
New Member
Topic starter
 

Good morning all !

I'm new in the numeric forensic science and I would like to know if someone also had my problem or know how to resolve it.

When I use the "Access Data FTK Imager" software to make an image of my Sandisk USB key of less than 20MB, I get an archive file (shouldn't it be of another extension?), As well as a dozen files such as "file 002", "file 003", "file 004", etc. And I have the text file.
I've that with the FTK Imager - Version 4.2.1 and I've also try with the version Lite 3.1.1

Do you know why I don't have only one file of type "file 001" like in the explanatory videos?

Thank you for reading and have a nice day!

 
Posted : 14/01/2020 6:48 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Good morning all !

I'm new in the numeric forensic science and I would like to know if someone also had my problem or know how to resolve it.

When I use the "Access Data FTK Imager" software to make an image of my Sandisk USB key of less than 20MB, I get an archive file (shouldn't it be of another extension?), As well as a dozen files such as "file 002", "file 003", "file 004", etc. And I have the text file.
I've that with the FTK Imager - Version 4.2.1 and I've also try with the version Lite 3.1.1

Do you know why I don't have only one file of type "file 001" like in the explanatory videos?

Thank you for reading and have a nice day!

Check this

In the Image Fragment Size field, specify the maximum
size in MB for each fragment of the image file.

On page 13 here

https://ad-pdf.s3.amazonaws.com/ImagerUsersGuide.pdf

jaclaz

 
Posted : 14/01/2020 7:04 pm
(@cc4n6)
Posts: 16
Eminent Member
 

You have a USB storage device that is less than 20 MB? Interesting.

What size are you setting the segment size? The default is 1500 MB with a compression of 6 I believe.
What type of out put are you setting the evidence file to be? E01, AD1 etc?

 
Posted : 14/01/2020 7:08 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

You have a USB storage device that is less than 20 MB? Interesting.

Ahhh the good ol' days, when a byte was a byte, made out of really round 0's and not too skinny 1's wink

https://www.techjunkie.com/retro-friday-8mb-16mb-and-32mb-usb-drives/

jaclaz

 
Posted : 14/01/2020 7:21 pm
Share: