Computer Forensics with FTK -- Table of Contents -- Computer Forensics with FTK -- Credits -- About the Author -- About the Reviewers -- www.packtpub.com -- Support files, eBooks, discount offers and more -- Why Subscribe? -- Free Access for Packt account holders -- Preface -- What this book covers -- What you need for this book -- Who this book is for -- Conventions -- Reader feedback -- Customer support -- Downloading color versions of the images for this book -- Errata -- Piracy -- Questions -- 1. Getting Started with Computer Forensics Using FTK -- Downloading FTK -- Prerequisites for FTK -- Installing FTK and the database -- Running FTK for the first time -- Summary -- 2. Working with FTK Imager -- Data storage media -- Acquisition tools -- Image formats -- The FTK Imager interface -- The menu bar -- The toolbar -- The view panes -- The FTK Imager functionality -- Adding and previewing an evidence item -- Creating forensic images -- Mounting the image -- The Capture Memory feature -- Obtaining the protected files -- Detecting the EFS encryption -- Summary -- 3. Working with Registry View -- Understanding the Windows registry structure -- The main feature of Registry Viewer -- Generating a report -- Integrating with FTK -- Identifying the Time Zone setting -- Account information -- Summary -- 4. Working with FTK Forensics -- Introducing computer forensics and FTK -- Preparation -- Acquisition and preservation -- Analysis -- Reports and presentation -- Managing groups and users -- Creating a new investigation case -- The FTK interface -- Case processing options -- Refining the case evidence -- Summary -- 5. Processing the Case -- Changing the time zone -- Mounting compound files -- File and folder export -- Column settings -- Creating and managing bookmarks -- The Additional Analysis feature -- Carving the data -- Narrowing the case with KFF.

Searching the case -- The Index Search and Live Search options -- Regular expressions -- Working with filters -- Reporting the case -- Summary -- 6. New Features of FTK 5 -- Distributed processing -- Encryption support -- Data visualization -- The Single-node enterprise -- Advanced volatile and memory analysis -- Explicit Image Detection -- Malware triage and analysis with Cerberus -- Mobile Phone Examiner -- Summary -- 7. Working with PRTK -- An overview of PRTK -- Understanding the PRTK interface -- Creating and managing dictionaries -- Starting a session for password recovery -- Managing profiles -- DNA -- Summary -- Index.