> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/resources-1/dfir-ftk-imager.md).

# DFIR FTK Imager

## FTK Image Create

1. **Select source**

<figure><img src="/files/bviohUGjbCGpnGYJ2HRr" alt=""><figcaption></figcaption></figure>

2. Se**lect Drive**
3. **Create Image**
4. **Select Image Type**

<figure><img src="/files/BCyx4EYEigtDGnt7G31n" alt=""><figcaption></figcaption></figure>

5. **Define the length of the segments or set it as "0" to create a single raw image.**<br>

   <figure><img src="/files/9l12y9r3RRZL3ZYXfDsG" alt=""><figcaption></figcaption></figure>

## Convert segments into a single raw file (dd)

```
copy /b filesprefix.* single.raw
```

The "**/b**" parameter means: **binary**.

## Convert from E01 files into single RAW file

```
ewfexport -t xxx.raw -f raw disco_1.E01
```

## Convert from  VMDK into RAW format with qemu

```
qemu-img convert xxxxx-flat.vmdk xxxxx.raw
```

## Convert from RAW format into VDI (VirtualBox)

```
VBoxManage convertdd xxxx.raw xxxx.vdi
```

## Change SAM Password to boot machines

### kon-bootCD-2.7.iso

{% file src="/files/f3MoUyEtBELPhwqKDR2f" %}

### cd140201.iso

{% file src="/files/5r3qSKvMTJM3nmpvj4pQ" %}

### Hirens' Boot

<figure><img src="/files/GOhbobDNfJATG2sBY9Xk" alt=""><figcaption></figcaption></figure>

{% embed url="<https://www.hirensbootcd.org/>" %}

### Can not you login after patch the SAM?

If you can't change the SAM file or the login doesn't work, you can simply create a ISO file with the needed tools (e.g.: velociraptor collector) and execute it locally with Hiron's Boot.

```
mkisofs -o output.iso input_directory
```

Add the iso file via CD drive on virtualbox.

Use the **dissect-shell** after that to dump the outputed .zip file with all the artifacts .&#x20;