Technical requirements
For this chapter’s exercise, we will utilize the virtual machine (VM) configured previously and install several tools for data acquisition and mounting, as follows:
- KAPE: https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape
- FTK Imager: https://www.exterro.com/ftk-imager
Important note
For labs, we will use KAPE and FTK Imager to acquire forensic evidence. We will use this evidence for educational purposes; however, the same applies to real-world incidents.