FTK Imager als Kommandozeilenversion

Access Data hat zusätzlich zur Vesion 2.9 seines FTK Imagers, eine Command Line Version für MacOS (10.5 und 10.6), Windos und Linux (Debian, Fedora und Ubuntu) veröffentlicht.Hiermit lassen sich nun wieder sehr gut Imaging-Boot-CD’s erstellen. Wer das AD-Format verwendet, kann die Daten auch gleich verschlüsseln. Ein Geschwindigkeitstest folgt in Kürze auf diesem Blog.

Download.

AccessData FTK Imager v2.9 CLI (May 20 2010)

Copyright 2006-2010 AccessData Corp., 384 South 400 West, Lindon, UT 84042

All rights reserved.

Usage:  ftkimager source [dest_file] [options]

source can specify a block device, a supported image file, or `-' for stdin

if dest_file is specified, proper extension for image type will be appended

if dest_file is `-' or not specified, raw data will be written to stdout

Options:

--help        : display this information

--list-drives : show detected physical drives

--verify      : hash/verify the destination image,

or the source image if no destination is specified

--print-info  : print information about a drive or image and then exit

--quiet       : do not show create/verify progress information

--no-sha1     : do not compute SHA1 hash during acquire or verify

(The following options are valid only when dest_file is specified):

--s01         : create a SMART ew-compressed image

--e01         : create an E01 format image

--frag x{K|M|G|T} : create image fragments at most x {K|M|G|T} in size

also accepts kB, MB, GB, and TB for powers of 10 instead of 2

--compress C  : set compression level to C (0=none, 1=fast, ..., 9=best)

e01/smart metadata (use quote marks when X contains spaces):

--case-number X

--evidence-number X

--description X

--examiner X

--notes X

AD Encryption Options:

--inpass P      : decrypt source file using password P

--incert C [P]  : decrypt source file using certificate C with password P

--outpass P     : encrypt dest file using password P

--outcert C [P] : encrypt dest file using certificate C with password P