Professional Documents
Culture Documents
Using Command Line Imager PDF
Using Command Line Imager PDF
Basic Instructions:
1. Download the appropriate Imager CLI package and unzip it.
2. Open a Terminal windows (Mac & Linux) or Command Prompt (Windows). Make sure the
Terminal/Command Prompt is run with elevated privileges (the “su” or “sudo” command on
Mac & Linux, right-click>Run as Administrator on Windows).
3. Use the “cd” command to navigate to the folder where you expanded the Imager CLI files.
4. Run the following command to list the physical drives attached to your system:
ftkimager --list-drives
5. Use a command in the structure of “ftkimager [source] [destination] [options]” to create an
image of your selected drive, where [source] is the physical path of the drive to image and
[destination] is the full path (excluding file extension) where the resulting image will be saved.
[source] can also be an image file for converting to another image format. Use quotes when
[source] or [destination] contain spaces. Reference the options listed below when formulating
the command.
Example:
To image the drive listed as \\.\PHYSICALDRIVE0 to an E01 named MyDrive on drive X:\ and encrypt the
image using the password test123, you would use the following command:
Advanced Usage
ftkimager [source] [destination] [options]
The following is a list of all possible options that can be used. Multiple options can be used in the same
command.
Option Functionality
--help Use this option without a [source] or [destination]
to display all possible options.
--list-drives Use this option without a [source] or [destination]
to list all detected physical drives.
--verify Verifies the image after creation if [destination] is
specified. Verifies the source image if
[destination] is not specified.
--print-info Displays information about a source. [source] can
be a physical drive or image file.
--quiet Hides all create or verify progress information.
--no-sha1 Does not compute SHA1 hash during the create or
verify process.
The following options can be used to add metadata to the destination image. Use quotes when X
contains spaces:
Option Functionality
--case-number X Specifies case number X.
--evidence-number X Specifies evidence number X.
--description X Specified evidence description X.
--examiner X Specifies examiner X.
--notes X Specifies evidence notes X.