Introduction

• Use forensic workstation and FTK Imager to image 2.5 inch SATA hard drives.

Connect TC4-8-R2 cable to hard drive​

1. Retrieve TC4-8-R2 cable (unified SATA/SAS signal and power connector) from adapter box # 1 in digital forensics lab supply area​.
   
   
   
2. Retrieve hard drive from Born Digital storage box (BD Box).
   
   
3. Connect SATA connector to hard drive SATA pins​.

Mount hard drive in Tableau T35689iu forensic bridge​

1. Insert hard drive into​ drive dock with pins outward​.
   
   
2. Connect 3M power connector to Tableau T35689iu forensic bridge​.
   
   
3. Connect SAS signal cable to SATA port in Tableau T35689iu forensic bridge​.
   
   
4. ​ Press the “Power” button on the Tableau T35689iu write-blocker​.
   
   

5. Ensure Pwr, Dev, Host, and WrtBlk lights are green​. Note: if the drive is successfully mounted, it should also pop up in a File Explorer window where you can navigate the write-blocked drive​ 

Identify disk number and volume letter for physical drive

1. Click on Windows start menu.
   
   
2. Right click on "Computer" and click on "Manage" to open the Computer Management window.
   
   
3. Navigate to Disk Management menu​.
   
   
4. Identify disk number and volume letter for desired physical source​.

Launch FTK Imager and initiate "Create Disk Image..." process

1. Double-click FTK Imager desktop icon or taskbar icon to launch program​.
   
   
2. Click on the “File”​ menu and click on the “Create Disk Image…” to open Select Source window​.
   
   
3. Select “Physical Drive” radio button Click “Next” button to open Select Drive window​

Verify successful creation of disk image

1. Check Disk Image MD5 window​. 
   
   
2. Close window​. 
   
   
3. Open Windows Explorer and confirm the following organization of data:​
   
   
   1. D:\DATA
      1. Fonds/Collection
         1. Accession folder​
            1. Evidence​
               1. EvidenceID
            2. Evidence – copies
               1. EvidenceID_copy​