Capturing Ram and Swap - Video 1 (7 minutes)

FTK Imager

Lecture Overview:

• How to put FTK Imager on a thumb drive:
• Download FTK Imager Lite - (0:27)
• Install - (1:35)
• FTK Imager Lite Interface - (3:23)
• Add physical drive - (4:09) 

Video:

• (Right click this link and use "Save As...") FTK Imager

Required Reading:

• Collecting Evidence from a Running Computer: A Technical and Legal Primer for the Justice Community 
• Techniques and Tools for Recovering and Analyzing Data from Volatile Memory

Additional Supporting Material:

• Download FTK Imager 3.2.0:
• AccessData Product Downloads
• Follow These Directions
• Run FTK Imager from a flash drive (Imager Lite) : Support Portal
• Original FTK Imager Lite 3.1.1
• FTK Imager Lite 3.1.1
• Original version of Lite which extracts directly to a USB