USB Forensic Imaging with FTK Imager

This project documents the process of creating a verified forensic image of a USB flash drive using FTK Imager. Completed as part of my self-learning journey in digital forensics.

Objectives

• Create a forensic image of a USB device
• Verify image integrity using MD5 and SHA1 hash values
• Capture and document each step with screenshots
• Share findings and workflow for educational purposes

Tools Used

• FTK Imager
• Windows Snipping Tool
• Canva (for video editing)
• GitHub (for documentation)

Screenshots

All steps are documented in the screenshots/ folder:

1. Launching FTK Imager
2. Adding USB as evidence
3. Creating disk image
4. Filling evidence info
5. Selecting destination
6. Imaging progress
7. Hash verification summary

Demo Video

A short 10-second walkthrough is available in the video/ folder.

Key Learnings

• Importance of hash verification in digital evidence
• How FTK Imager preserves forensic integrity
• Basics of forensic imaging workflow

File Structure

See notes.md for additional reflections and technical notes.

---

Feel free to fork or clone this repo if you're learning digital forensics or preparing for cybersecurity certifications.