Jan. 29, 2023, 6:10 p.m. | /u/RESP-svee-T

Computer Forensics www.reddit.com

Is there a way to generate a logical image of a drive with ftkimager command line interface without the unallocated space? I’m currently testing with generating E01s by using the drive’s logical path as a source, but by default, it includes the unallocated space, and it doesn’t accept folder paths, or doesn’t seem to have any attributes to exclude unallocated space. So it seems like I’m just creating a physical E01 image of a partition. Am I missing something or …

accept attributes cli command command line computerforensics default drive folder interface path physical space testing

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

Information Security Engineers

@ D. E. Shaw Research | New York City

SOC Cyber Threat Intelligence Expert

@ Amexio | Luxembourg, Luxembourg, Luxembourg

Systems Engineer - SecOps

@ Fortinet | Dubai, Dubai, United Arab Emirates

Ingénieur Cybersécurité Gouvernance des projets AMR H/F

@ ASSYSTEM | Lyon, France

Senior DevSecOps Consultant

@ Computacenter | Birmingham, GB, B37 7YS