Introduction

Create new case in FTK.
Extract inventory of digital storage devices from SharePoint register.
Use inventory as checklist, ensure previous accessioning and registration work is accurate and complete.
Select evidence processing profile. Field mode involves minimal processing and is the fastest way to add evidence items to a case.
Add forensic image files to case.
Run additional analysis as needed.

Step four - create case in Forensic Toolkit (FTK)