Installing FTK Imager Lite in Linux Command Line

Using the SANS SIFT workstation you have many options available when you are trying to image a hard drive, no matter if it is: dead, alive, internal, or external.  One of my favorite tools to image with is the FTK Imager command line program.   It is a lightweight, fast, and efficient means to extract the image from your suspect drive.  You can run the CMD line program on any operating system with very little difference in syntax but I will be focusing on the Linux version that comes with SIFT.

This blog post will focus on downloading and installing FTK Imager on your computer and I will put up another post in a couple days about how to actually use the command line tool.  I didn't want to overwhelm readers with a huge block of text so I decided to break up the information into two separate posts.

Before we can use FTK Imager we need to have it installed on the computer.  If you have SIFT it is already installed and you do not need to know how to install it but other versions of Linux do not have it installed by default and need to grab it from (http://www.accessdata.com/support/product-downloads).  You can select the version that you need and it will be downloaded to your machine for installation.

 I am assuming that the majority of people reading this will know at least a small bit about Linux that they will be able to install it without any troubles but for those of you who are completely new to the glory that is Linux I will give you a short explanation of how to install FTK on your computer. 

First thing is first, find out whether you have a 32-bit or 64-bit version of Linux by typing the following command in the terminal uname –m. if it comes back with “x86_64” then you have a 64-bit kernel and if it comes back with “i686” you have a 32-bit kernel.  Select the appropriate version and download it to whatever directory that you use, it is set to the Downloads folder by default. 

You can install it through the GUI, but what fun is that?  We are using Linux so we should know how to do everything through the terminal because it really allows you to know what is going on under the hood as well as making you feel like a superstar computer user. 

Upon downloading the file to the Downloads folder, open up your terminal and navigate there by using the cd command.  If you want to cheat and are in your own accounts terminal rather than root you can just type cd ~/Downloads. The ~ character represents your home folder and if used in with the cd command will take you to your home folder no matter where you are in the computer.  When you get to the Downloads folder you can use the ls command to view all of the files in that directory. (On a side note I use the words directory and folder interchangeably when dealing with Linux, which they are) Determine what the FTK download is named, usually “ftkimager.x.x.x_UbuntuXX.tar.gz where x.x.x stands for the version number of FTK that was downloaded and XX is the version that was selected (32 or 64 bit).

The next step is to extract the executable from the tar.gz file by using the command sudo tar –zxvf [filename] the switches used mean different things and must be used in the correct case, in this instance they are all lower case.  The z is for the .gz portion of the compression, x is to extract the information from the .tar portion of the compression, v stands for verbose but this switch is optional, and finally f stands for the file that will be extracted from. 

HURRAY!!! We now have the file extracted and are ready to install it and start acquiring everything in sight! Now installing this can be incredibly difficult for anyone, even those with lots of experience…. No not really, it is actually as simple as moving the extracted file to a new directory.  Now I am going to use the directory that SIFT uses for ftkimager: “/usr/local/bin/”.  The syntax for the move is simple: sudo mv ftkimager /usr/local/bin/ and that is all there is to it.  

Now we are ready to start using the command line version of FTK Imager.