SIFT Workstation: Video 2 – Acquire HDD/USB Drives via Command Line

Welcome back for my second video.

In this video we cover a couple different applications to acquire images from hard drives/USB drives. Before we can really analyze anything we need to have some images to start with. During this video I am going to acquire an image from a USB thumb drive using dcfldd and ftkimage lite 2.9, both of which are pre-installed on SIFT. I will also show you how to use netcat* so you can image a drive over the network as well.