Introduction

1. Create new case in FTK.
   
   
2. Extract inventory of digital storage devices from SharePoint register.
   
   
3. Use inventory as checklist, ensure previous accessioning and registration work is accurate and complete. 
   
   
4. Select evidence processing profile. Field mode involves minimal processing and is the fastest way to add evidence items to a case.
   
   
5. Add forensic image files to case.
   
   
6. Run additional analysis as needed.

Prepare checklist of digital storage devices

1. Log into SharePoint and export register of digital storage devices to Excel. The exported list is a temporary file. Discard the file after all images have been added to the case in FTK.
   
   
   1. Option 1: Export entire register and use Excel filters to filter the list based on Collection ID and/or Accession number.
      
      
   2. Option 2: Use Collection ID and/or Accession number columns to filter the list and create a new list view before exporting the register.