FTK Imager Hands on Labs

Interactive Lab

Browser based

FTK Imager Interactive Lab

Expand labOpen in new tab

✓ No installation

Preserve a training USB volume in an FTK Imager style workspace, verify the image, find a note and make a supported finding.

CASE SUSA-041 · 8 to 12 MINUTES

Preserve the volume. Find the handover note.

A reported USB handover needs review. Your job: preserve the authorised volume, verify the image, then find the note in a working copy.

Beginner · guided simulation

Your acquisition plan

Authority: image only E:\ [TRAINING-USB], NTFS, 512 MB. Source protection is already in place in this fictional case. A logical volume image does not capture other partitions, the whole device or memory.

Case / evidence

SUSA-041 / TRAINING-USB

Format / filename

E01 / SUSA-041-TRAINING-USB

Separate evidence disk

D:\SUSA-041\Images (10 GB free)

Browser practice only. Drives, hashes and progress are simulated; FTK Imager does not run or access your computer. The workspace follows the classic 4.7 interface used in the guide; only this case's actions are enabled.

1. 1Choose source
2. 2Create image
3. 3Verify & preserve
4. 4Find & explain

Exterro FTK Imager 4.7.3.81−　□　×

TTEXT 01HEX ?

Evidence Tree

No evidence items added.

File List

Name	Size	Type	Date Accessed	Date Created	Date Modified

Properties

Selection

None

PropertiesHex Value InterpreterCustom Content

Viewer Text

Select a file to preview its contents.

ReadyTraining simulation

Full Lab

Self hosted / real acquisition

FTK Imager Full Lab

VM + two training disks

Case SUSA-041 / preserve the volume

Image it. Verify it. Find the note.

An examiner needs a preserved copy of a small removable volume before reviewing its files. Use a tiny virtual training disk as the stand in: create a harmless note, image its volume, then find and export the note from the saved image. Can you show that the exported bytes match your recorded training file?

Tick a checkpoint only after saving its evidence. Progress is self reported; this page cannot check your VM or image.

Investigation brief

Case questionCan we verify the acquired training volume and recover the note with matching content?

Acquisition scope

One NTFS volume: E:\, labelled TRAINING-USB. Save an E01 image to the separate evidence disk at D:\SUSA-041\Images.

Real case connection: identify and protect the source, acquire the authorised scope, verify the result, review a working copy, and hand over the evidence. A Logical Drive image covers the selected volume; it does not capture the whole physical device, other partitions, or memory.

Before you start

Need: a disposable Windows 10 or 11 VM, administrator access, Windows PowerShell 5.1, FTK Imager, and a clean snapshot. Attach a new, empty 512 MB: 1 GB virtual disk as E: with NTFS and label TRAINING-USB. Attach a different writable evidence disk as D:, with free space for the image, its working copy and exports.

Your route: complete three activities. Open one numbered step at a time and check each Look for result. Keep the same PowerShell window through Activity 1. The core lab uses FTK Imager and built in PowerShell only; extra analysis is optional.

Need setup help?

Use your hypervisor to attach two additional virtual disks to the VM. In Disk Management, initialise and format only those new, empty disks, then assign the source E: and evidence D:. Resolve existing drive letter use first. Do not repartition the Windows disk or a disk containing your files. The small virtual source stands in for a USB volume; no physical USB is required.

Follow Install and open FTK Imager. Record the downloaded filename, official source/date, checksum and actual installed version. The guide and simulation show 4.7.3.81; your build's labels may differ. Keep the evidence disk outside snapshot rollback, or copy the case outside the VM before resetting it.

The lab sets the prepared source disk read only in Windows. This is a training safeguard, not a hardware write blocker. For real removable evidence, follow the approved acquisition procedure and use a suitable write blocker; Exterro's guide explains source protection. Attaching an unprotected volume to Windows can change metadata before acquisition.

Activity 1: Prepare the environment

Your first winA known source, separate destination and a harmless note with a saved fingerprint.

1. Identify the source and create a fresh case

Open Windows PowerShell as administrator on the VM. These checks require the small labelled source and reject the Windows disk or a shared source/destination disk. Check the displayed disk identities against the two disks you attached; a label alone is not an evidence identifier.

$ftkCase = 'D:\SUSA-041'
$ftkImages = Join-Path $ftkCase 'Images'
$ftkVolume = Get-Volume -DriveLetter E -ErrorAction Stop
$ftkSourceDisk = Get-Disk -Number (Get-Partition -DriveLetter E -ErrorAction Stop).DiskNumber
$ftkDestinationDisk = Get-Disk -Number (Get-Partition -DriveLetter D -ErrorAction Stop).DiskNumber
if ($ftkVolume.FileSystemLabel -ne 'TRAINING-USB' -or $ftkVolume.FileSystem -ne 'NTFS' -or $ftkVolume.Size -gt 1GB) {
    throw 'Use the small NTFS training volume labelled TRAINING-USB.'
}
if ($ftkSourceDisk.IsBoot -or $ftkSourceDisk.IsSystem -or $ftkSourceDisk.Number -eq $ftkDestinationDisk.Number) {
    throw 'Source must be a separate training disk, not Windows or the destination.'
}
if ((Get-Volume -DriveLetter D).SizeRemaining -lt (3 * $ftkVolume.Size)) { throw 'Allow space for the image, working copy and case records.' }
if (Test-Path -LiteralPath $ftkCase) { throw 'Case folder exists. Choose a new case path.' }
New-Item -ItemType Directory -Path $ftkImages -ErrorAction Stop | Out-Null
[pscustomobject]@{
    HostName = $env:COMPUTERNAME
    Time = Get-Date -Format o
    TimeZone = (Get-TimeZone).Id
    Source = 'E:\'
    Label = $ftkVolume.FileSystemLabel
    VolumeId = $ftkVolume.UniqueId
    VolumeBytes = $ftkVolume.Size
    DiskNumber = $ftkSourceDisk.Number
    DiskUniqueId = $ftkSourceDisk.UniqueId
    DestinationDisk = $ftkDestinationDisk.Number
} | Export-Csv -LiteralPath "$ftkCase\source-context.csv" -NoTypeInformation
$ftkSourceDisk, $ftkDestinationDisk | Select-Object Number, FriendlyName, UniqueId, Size, IsReadOnly | Format-List

Look for: different source and destination disk numbers, the expected sizes, and source-context.csv on D:. In Notepad, create case-context.txt in the case folder and record case SUSA-041, authority, clean snapshot, FTK Imager version and download provenance. If you change the case path, use it consistently below.

2. Create the note, record it, then protect the source

This is deliberate staging on the empty training volume, before acquisition. The commands recheck its identity, create Training\handover-note.txt, save a SHA-256 fingerprint on D:, and set the source disk read only. Do not edit or open the live source in Explorer after this step.

$ftkRecordedSource = Import-Csv -LiteralPath "$ftkCase\source-context.csv"
$ftkVolume = Get-Volume -DriveLetter E -ErrorAction Stop
$ftkSourceDisk = Get-Disk -Number (Get-Partition -DriveLetter E -ErrorAction Stop).DiskNumber
if ($ftkVolume.UniqueId -ne $ftkRecordedSource.VolumeId -or $ftkSourceDisk.UniqueId -ne $ftkRecordedSource.DiskUniqueId) {
    throw 'Source identity changed. Stop and check the training disks.'
}
$ftkSeedFolder = 'E:\Training'
if (Test-Path -LiteralPath $ftkSeedFolder) { throw 'Training folder exists. Use a fresh empty training source.' }
New-Item -ItemType Directory -Path $ftkSeedFolder -ErrorAction Stop | Out-Null
$ftkSeed = Join-Path $ftkSeedFolder 'handover-note.txt'
'SUSA-041 harmless training note: hand over the blue folder.' |
    Set-Content -LiteralPath $ftkSeed -ErrorAction Stop
Get-Item -LiteralPath $ftkSeed | Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc |
    Export-Csv -LiteralPath "$ftkCase\training-file.csv" -NoTypeInformation
Get-FileHash -Algorithm SHA256 -LiteralPath $ftkSeed |
    Export-Csv -LiteralPath "$ftkCase\training-file-sha256.csv" -NoTypeInformation
Set-Disk -Number $ftkSourceDisk.Number -IsReadOnly $true -ErrorAction Stop
Get-Disk -Number $ftkSourceDisk.Number | Select-Object Number, UniqueId, IsReadOnly |
    Export-Csv -LiteralPath "$ftkCase\source-protection.csv" -NoTypeInformation
Get-Disk -Number $ftkSourceDisk.Number | Select-Object Number, IsReadOnly

Look for: IsReadOnly is True, and the training file records are saved on the evidence disk. If protection fails, stop and resolve it before imaging. Record the intentional file creation and protection method in the case notes. The staged note is known training data, not a real incident finding.

Ready to image I saved the source identifiers, VM/snapshot, time zone, tool provenance and separate destination. I saved the note's path, timestamps and SHA-256, and confirmed the training source is read only.Pause point: keep the prepared source and case records. Do not change the source before acquisition.

Next: acquire only the authorised training volume.

Continue to imaging ›

Activity 2: Acquire and verify

Your next winOne E01 image with a retained verification result and acquisition record.

Make your prediction

If the image verifies, does that prove who wrote the note? Predict what matching verification values establish before you run the acquisition.

1. Select the volume and configure the image

Open FTK Imager as administrator. Follow Create and verify an image for screenshots, using the small training source instead of the screenshot's Windows drive.

Setting	Choose for this lab
File → Create Disk Image	Logical Drive
Source	E: labelled TRAINING-USB; confirm identity and size from your case notes
Add → image type	E01
Evidence information	Case SUSA-041, evidence TRAINING-USB, your name and a description of the training volume
Destination	D:\SUSA-041\Images (or your fresh case's Images folder)
Filename	SUSA-041-TRAINING-USB
Fragment size / compression	Use the offered defaults and record the actual values
Verification	Keep Verify images after they are created checked

Why Logical Drive? The lab authorises one volume. This captures that volume's sectors, including its filesystem and unallocated space within that scope. Physical Drive widens the scope to the whole device; Contents of a Folder is a different, file based acquisition. Do not select C:, the evidence disk, or an unrelated physical drive.

Look for: the correct source, unique filename, separate destination and enabled verification. Save a screenshot and these settings to acquisition-notes.txt in the case folder. Stop if the read only source is missing; recheck the disk and drive mapping instead of substituting another source.

2. Acquire once, then read the verification result

Record the start time, select Start, and wait for both acquisition and verification to finish. Record the finish time, image size, read errors, warnings and outcome. Retain the acquisition log and verification summary with the image; save a screenshot before dismissing the result window.

Look for: the first .E01 file and any additional segments, plus verification marked Match for the reported algorithms. The referenced build uses MD5 and SHA-1: compare computed and stored values for the same algorithm. Record whatever your actual build reports. A small source may produce only one segment; do not try to match a screenshot's size or file count.

Keep all segments together. E01 is a forensic container; verification checks the acquired data it represents. A later SHA-256 of an .E01 file fingerprints the container file and will not equal an internal MD5/SHA-1 verification value.

Space warnings, read errors, or a mismatch?

What you see	First check
Low space warning	Stop and increase destination capacity. Do not rely on compression to rescue an undersized destination.
Source unavailable	Check the recorded source disk, drive letter, protection state and administrator access.
Read errors or bad blocks	Preserve the log and affected ranges; matching hashes do not erase the gap.
Verification skipped or mismatched	Preserve the run and investigate settings, source changes, storage and segment completeness. Do not label it verified.
Need to retry	Keep the first image and logs. Use a new empty destination and record why. Never overwrite the failed attempt.

Acquisition preserved I saved the source, format, evidence identifiers, destination, filename and verification settings. I kept all image segments, logs, times, actual verification values/results and any read errors or retries.Pause point: the saved image is enough for review. Keep the source protected; you do not need to image it again.

Next: inspect a working image and recover the note.

Investigate the image ›

Activity 3: Review and report

Your final winA note exported from the image, with a content comparison you can explain.

Returning in a new PowerShell window?

If the working copy already exists, restore these paths and continue at Step 2. Use your actual case path if you changed it. Do not overwrite the existing image or copy.

$ftkCase = 'D:\SUSA-041'
$ftkWorking = Join-Path $ftkCase 'WorkingImage'
$ftkExport = Join-Path $ftkCase 'Export'

1. Create and check a complete working image

Use the same PowerShell window, or run this block in a new one. It restores the case paths, fingerprints all retained image files/logs, and checks the copied files. A hash is a file fingerprint; the SHA-256 manifest below checks the saved files, separately from FTK's image data verification.

$ftkCase = 'D:\SUSA-041'
$ftkImages = Join-Path $ftkCase 'Images'
$ftkWorking = Join-Path $ftkCase 'WorkingImage'
$ftkExport = Join-Path $ftkCase 'Export'
$ftkFiles = @(Get-ChildItem -LiteralPath $ftkImages -Recurse -File -Force -ErrorAction Stop)
if (@($ftkFiles | Where-Object Extension -EQ '.E01').Count -ne 1) { throw 'Expected one first E01 segment. Inspect the saved run.' }
if (Test-Path -LiteralPath $ftkWorking) { throw 'Working image exists. Keep it and resume at Step 2.' }
$ftkManifest = @($ftkFiles | ForEach-Object {
    [pscustomobject]@{
        RelativePath = $_.FullName.Substring($ftkImages.Length + 1)
        Length = $_.Length
        SHA256 = (Get-FileHash -Algorithm SHA256 -LiteralPath $_.FullName -ErrorAction Stop).Hash
    }
})
$ftkManifest | Export-Csv -LiteralPath "$ftkCase\image-files-sha256.csv" -NoTypeInformation
Copy-Item -LiteralPath $ftkImages -Destination $ftkWorking -Recurse -ErrorAction Stop
foreach ($ftkFile in $ftkManifest) {
    $ftkCopied = Join-Path $ftkWorking $ftkFile.RelativePath
    if ((Get-FileHash -Algorithm SHA256 -LiteralPath $ftkCopied -ErrorAction Stop).Hash -ne $ftkFile.SHA256) {
        throw 'Working copy mismatch. Preserve the error and check storage.'
    }
}
'Every copied file matches its recorded SHA-256.' |
    Set-Content -LiteralPath "$ftkCase\working-copy-check.txt"

Look for: WorkingImage, image-files-sha256.csv and working-copy-check.txt. In FTK Imager, choose File → Add Evidence Item → Image File and select the first .E01 in WorkingImage. Keep later segments beside it. Select the loaded image and use File → Verify Drive/Image, recording the result as working-image-verification in your case notes or screenshot. If verification fails, preserve the failure and resolve it before treating the image as verified.

2. Find the note and compare the exported bytes

Expand the loaded image in FTK Imager's Evidence Tree. Navigate to its root and Training folder, then select handover-note.txt. Preview the text and record the path and file size shown. You should see the phrase about the blue folder. This is review of the saved image, not the live E: drive.

Create an Export folder under the case on D:. Right click the note in FTK Imager and choose Export Files, exporting it to that folder. Confirm the actual exported path. Then compare its SHA-256 with the training fingerprint saved before acquisition:

$ftkExpected = @(Import-Csv -LiteralPath "$ftkCase\training-file-sha256.csv")
if ($ftkExpected.Count -ne 1 -or $ftkExpected[0].Path -ne 'E:\Training\handover-note.txt') {
    throw 'Check the recorded training fingerprint.'
}
$ftkRecovered = Join-Path $ftkExport 'handover-note.txt'
$ftkActual = Get-FileHash -Algorithm SHA256 -LiteralPath $ftkRecovered -ErrorAction Stop
[pscustomobject]@{
    ExportedPath = $ftkActual.Path
    ExpectedSHA256 = $ftkExpected[0].Hash
    ExportedSHA256 = $ftkActual.Hash
    Match = $ftkActual.Hash -eq $ftkExpected[0].Hash
} | Export-Csv -LiteralPath "$ftkCase\note-comparison.csv" -NoTypeInformation
Import-Csv -LiteralPath "$ftkCase\note-comparison.csv" | Format-List

Look for: Match: True. That supports matching file content between the recorded training file and this export. It does not prove authorship or when someone read the note. A mismatch is worth investigating: check the selected image, exact file, export path and recorded fingerprint. Keep the result and explain the gap; do not replace it with a matching copy from the live source.

3. Make the analyst's call and write your handover

Make the analyst's callThe image verifies and the exported note matches its training fingerprint. Which finding can you defend?

We proved who wrote and read the note.The image verified, and the export matches the recorded training file content; authorship still needs other evidence.We captured the whole physical device and all memory.

Choose a finding, then use your actual verification and comparison results below.

Save this short template as handover.txt in your case folder. Include mismatches or read errors honestly rather than copying a success claim.

Case SUSA-041: preserve the training volume and recover the note.
Authority, operator, VM, snapshot and time zone:
Source volume/disk identifiers, size, and protection method/limits:
FTK Imager version, provenance and acquisition settings:
Image destination, first E01 and all segment names:
Acquisition start/finish, log path, errors and verification algorithms/results:
Saved-file SHA-256 manifest, working-copy check and FTK re-verification:
Image path of note, export path, file size and note-comparison.csv result:
Observation: what the saved image and exported bytes show.
Interpretation: supported meaning, confidence and reasons.
Limits: single volume scope, training staging, source protection, errors, no authorship proof.
Next check: one source that could help answer the remaining case question.
Closeout: retained case checked; training disks and VM reset plan recorded.

Choose a next check: examine file metadata and other case evidence for provenance or use of the note. Treat the text as content, not proof that its statements are true. Keep any proposed follow up separate from what acquisition and hashes already establish.

Optional challenge: compare the note's metadata

Compare the file size and timestamps visible in FTK Imager with training-file.csv. That file records UTC; check the display's time convention before comparing. Explain why a timestamp might help place a file in context but does not identify its author. Also describe what a Physical Drive image would add to this volume only scope. No deleted file recovery is required or guaranteed in this lab.

Case closeout4. Keep the evidence before resetting the training disks

Preserve first

Keep the complete image set, logs, verification records, manifests, working image, export and handover. Copy the case outside the VM or retain the separate evidence disk, and open the retained copy before rollback.

Close FTK Imager and PowerShell and shut down the disposable VM. Record closeout in the handover. Restore the training baseline or discard only the specifically identified disposable source disk through your hypervisor; do not reset or discard the retained evidence disk. A Windows only snapshot may not reset additional disks, so check what your snapshot includes. Keep the prepared source read only until you deliberately reset that training disk.

Look for: a readable retained case and a recorded plan or completed reset of the disposable VM/source. Do not delete the note from the protected source just to tidy up, and do not remove failed acquisitions from the case.

Ready for another analyst I saved the copy/hash checks, working image verification, note comparison, and a finding with limits and a next check. I opened and checked the retained case and recorded the disposable VM/source closeout or reset plan.Completion means saved evidence and explained gaps. Failed verification is not a verified image; the optional metadata challenge is not required.

Finish with a note another analyst can check against the image and export.

Review the evidence checklist ›

Full Lab evidence checklist

Case folder handoverSave the two checkpoints in each activity.

• 1Contextcase-context.txt, source-context.csv, source-protection.csv, training-file.csv and training-file-sha256.csv
• 2AcquisitionAll image segments in Images/, acquisition log, settings/results screenshots and acquisition-notes.txt; keep failed/retried runs separately
• 3Findingimage-files-sha256.csv, WorkingImage/, working-copy-check.txt, working image verification record, Export/, note-comparison.csv and handover.txt; explain missing records or hash failures

Your win: you can connect a protected training volume, its verified image and an exported file, while stating what the result leaves unanswered.