Introduction

Create new case in FTK.
Extract inventory of digital storage devices from SharePoint register.
Use inventory as checklist, ensure previous accessioning and registration work is accurate and complete.
Select "Field mode" processing profile.
Add forensic image files to case.
Run additional analysis as needed.

Step four - create case in Forensic Toolkit (FTK)