Source: Juni_2026_Exams/Advance_Forensics/notes/03-ftk-imager-workflow.md

📸 FTK Imager Workflow Guide

What is FTK Imager?

FTK Imager is a forensic tool that lets you open forensic images (like .001 or .E01 files) and browse them as if they were a regular hard drive. It's your gateway to evidence extraction.

🎯 Primary Use Cases for Exams

1. Open forensic image → Browse files and folders
2. Extract registry hives → Export for Registry Explorer analysis
3. Export $MFT → Find deleted files
4. Export .lnk files → Analyze file access history
5. Find specific files → Locate evidence

🚀 Step-by-Step: Opening a Forensic Image

Step 1: Launch FTK Imager

Windows:
C:\Program Files\AccessData\FTK Imager\FTKImager.exe

Or: Start Menu → FTK Imager

Step 2: Add Evidence Item

1. File → Add Evidence Item
   OR
   Icon: Add Evidence Item (left toolbar)

2. Select option:
   - Physical Drive (for USB/external drives)
   - Logical Drive (for a partition)
   - Image File (for .001, .E01, .dd files)
   
3. Choose: Image File

Step 3: Select Forensic Image

1. Browse to forensic image location
2. Select first part (e.g., image.001)
3. If multiple segments: FTK will auto-detect and load all
4. Click: Open
5. Wait: FTK loads image into memory (may take 1-10 min)

Step 4: Browse the Evidence

In left pane: File tree structure
├── Unallocated Space
├── C: [Drive]
│   ├── Users
│   ├── Windows
│   │   ├── System32
│   │   │   └── config ← Registry hives
│   │   └── Prefetch
│   ├── Temp
│   └── Recycle Bin
└── [Other partitions]

💾 How to Export Registry Hives

Hive Locations

C:\Windows\System32\config\
├── SOFTWARE       ← System software config
├── SYSTEM         ← Computer name, shutdown, hardware
├── SAM            ← User accounts
├── SECURITY       ← Security policies
└── DEFAULT        ← Default user profile

Export Workflow

Step 1: Navigate to registry location

In FTK Imager tree:
C: → Windows → System32 → config

Step 2: Find the hive file

Right-pane shows files:
- SOFTWARE (no extension)
- SYSTEM (no extension)
- SAM (no extension)
- etc.

Step 3: Export hive

1. Right-click file (e.g., SOFTWARE)
2. Select: Export → Export File(s)
   OR: Ctrl+E

3. Choose destination folder (e.g., D:\Evidence\Registry)

4. FTK exports to that folder

Step 4: Verify export

Check destination folder:
D:\Evidence\Registry\
├── SOFTWARE
├── SYSTEM
├── SAM
└── [others]

Export NTUSER.DAT (Per-User Settings)

Locations:
C: → Users → [Username] → NTUSER.DAT
   ↑
Repeat for each user

Export same way as above

📋 How to Export $MFT (Master File Table)

What is $MFT?

• $MFT is a hidden system file that tracks ALL files on the drive (including deleted)
• Location: Root of drive (usually not visible in normal Windows)
• Size: Can be very large (MB to GB)
• Used for: Finding deleted files, original paths, timestamps

Export Workflow

Step 1: Find $MFT

In FTK tree:
C: (root level)

Look for: $MFT (may need to scroll, it's huge)

Or search: Ctrl+F → search "$MFT"

Step 2: Right-click and export

1. Right-click: $MFT
2. Export → Export File(s)
3. Choose destination: D:\Evidence\MFT
4. Save as: MFT (or keep name)

Step 3: Verify export

Check size: Should be several MB minimum
If <1 KB: Export failed, retry

Result: D:\Evidence\MFT\$MFT

🔗 How to Export .LNK Files (Recent Shortcuts)

Where LNK Files Are

C: → Users → [Username] → AppData → Roaming → 
Microsoft → Windows → Recent

Or: Recycle Bin shortcuts

C: → $Recycle.Bin → [user-folder] → [shortcuts]

Export Workflow

Step 1: Navigate to Recent folder

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Recent

Or use Recycle Bin location

Step 2: Select all .lnk files

1. Ctrl+A (select all in folder)
   OR
2. Click first .lnk file
   Shift+Click last .lnk file (to select range)

Step 3: Export

1. Right-click selected files
2. Export → Export File(s)
3. Choose destination: D:\Evidence\LNK

Step 4: Verify export

Count of .lnk files exported
Should be 5-50+ files typically

Result: D:\Evidence\LNK\
├── document1.lnk
├── document2.lnk
└── malware.lnk

🔍 How to Browse and Search

Simple File Browse

1. Click drives in left pane
2. Double-click folders to open
3. Right pane shows files
4. Look for specific filename

Search Function

1. Ctrl+F (Search)
2. Enter filename (e.g., "malware.exe")
3. Click: Search
4. Results show all matching files
5. Click result to navigate to location

Find Recently Modified Files

1. Look at "Modified" column (right pane)
2. Sort by date: Click column header
3. Identify suspicious recent modifications

👤 How to Find User Folders

Standard User Folder Structure

C: → Users → [Username]
         ├── Desktop
         ├── Documents
         ├── Downloads
         ├── Pictures
         ├── Videos
         ├── AppData
         │   ├── Local
         │   ├── LocalLow
         │   └── Roaming
         ├── Favorites
         ├── Links
         └── NTUSER.DAT (user registry)

Navigation in FTK

1. C: → Users
2. Look at usernames (not System, Public, etc.)
3. Expand each user folder
4. Browse for suspicious files

Common Evidence Locations

C:\Users\[Username]\Desktop
→ Suspicious executables? Downloads?

C:\Users\[Username]\Documents
→ Important files, work projects

C:\Users\[Username]\Downloads
→ Downloaded malware? Suspicious files?

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Recent
→ Recently accessed files

C:\Users\[Username]\AppData\Local\Temp
→ Temporary files, cache

⚡ Quick Export Checklist

When you have a forensic image, export these in order:

• [ ] Registry hives (SOFTWARE, SYSTEM, SAM)
• [ ] SOFTWARE → D:\Evidence\Registry\SOFTWARE
• [ ] SYSTEM → D:\Evidence\Registry\SYSTEM
• [ ] SAM → D:\Evidence\Registry\SAM
• [ ] All NTUSER.DAT files → D:\Evidence\Registry\

• [ ] $MFT
• [ ] $MFT → D:\Evidence\MFT\$MFT

• [ ] .LNK files
• [ ] All .lnk files → D:\Evidence\LNK\

• [ ] Suspicious files
• [ ] Any identified malware → D:\Evidence\Files\
• [ ] All .exe files from Temp → D:\Evidence\Files\

• [ ] System files (optional)
• [ ] Prefetch files → D:\Evidence\Prefetch\

🎓 Hands-On Practice

Practice 1: Basic Navigation (5 min)

1. Open forensic image
2. Browse C: drive
3. Find Users folder
4. List usernames

Practice 2: Export Registry (10 min)

1. Navigate to C:\Windows\System32\config
2. Export SOFTWARE hive
3. Export SYSTEM hive
4. Verify files exist
5. Note file sizes

Practice 3: Export $MFT (5 min)

1. Find $MFT at C: root
2. Export to folder
3. Note file size (should be several MB)

Practice 4: Search for Files (5 min)

1. Use Ctrl+F to search
2. Search for: "malware.exe"
3. Document all found locations
4. Check modification times

Practice 5: Extract Evidence (10 min)

1. Find and export registry hives
2. Find and export $MFT
3. Find and export .lnk files from Recent
4. Verify all exports
5. Note export times

⚠️ Common Mistakes

❌ Mistake 1: Exporting from wrong location

• Wrong: Exporting registry from running Windows (C:\Windows\System32\config)
• Right: Always export from forensic image in FTK Imager

❌ Mistake 2: Not waiting for large exports

• Wrong: Exporting $MFT and immediately checking (still copying)
• Right: Wait for operation to complete, watch status bar

❌ Mistake 3: Confusing registry hive names

• Wrong: Looking for "NTUSER.DAT" in System32\config (it's per-user)
• Right: Look in C:\Users\[Username]\NTUSER.DAT

❌ Mistake 4: Corrupted exports

• Wrong: Using partial/corrupted exported file
• Right: Verify file size > 0 KB, then open in Registry Explorer

❌ Mistake 5: Forgetting about multiple users

• Wrong: Only exporting hives for one user
• Right: Export all NTUSER.DAT files from all users

💡 Pro Tips

Tip 1: Organize Exports

Create folder structure BEFORE exporting:
D:\Evidence\
├── Registry
│   ├── SOFTWARE
│   ├── SYSTEM
│   ├── SAM
│   └── Users_NTUSER_DAT
├── MFT
├── LNK
├── Suspicious_Files
└── Notes.txt

Tip 2: Note File Timestamps

When exporting, note the timestamp
(will help verify image consistency)

Export log should show:
- Filename
- Size
- Timestamp of export

Tip 3: Verify Export Integrity

Before moving to analysis:
1. Check file size (should match original)
2. Try opening in Registry Explorer
3. If corrupt, re-export

Tip 4: Search Before Export

If looking for specific file:
1. Search in FTK first (Ctrl+F)
2. Get exact path
3. Then export strategically
(Don't export entire drive)

📝 Exam Workflow Template

Question: "Find all evidence of unauthorized access"

1. Open forensic image in FTK Imager
2. Search for: "backdoor.exe", "nc.exe", "psexec.exe"
3. Document all findings with paths
4. Export suspicious files → D:\Evidence\
5. Export registry hives → D:\Evidence\Registry\
6. Export $MFT → D:\Evidence\MFT\
7. Open Registry Explorer with exported hives
8. Check Run keys for persistence
9. Open MFT Explorer with exported $MFT
10. Search for deleted suspicious files
11. Document all findings
12. Write answer with evidence paths

🔗 Next Steps

1. ✅ Read this guide
2. ✅ Open a sample forensic image
3. ✅ Navigate to C:\Windows\System32\config
4. ✅ Export one registry hive (e.g., SOFTWARE)
5. ✅ Verify export in destination folder
6. ✅ Find and export $MFT
7. ✅ Practice with all export types
8. ✅ Move to: Registry Explorer Guide

Last Updated: June 15, 2026