1. Click “Open Disk Image…”
2. Click the “…” button.
3. Navigate to the Image. Change to “All Files”
4. Select the Image.
5. Hit “OK”
The image is now loaded.
How to Navigate an NTFS Image
1. Click “My Computer”
This will give you a list of all partitions in the Image
2. Select the Partition.
NTFS Forensic Analysis
Using Active@ to parse NTFS
You can NOT tell the OS from the Boot sector.
How many sectors is the Partition?
The file-system is stored on a Hard disk.
This cluster is the start of the MFT.
How many Clusters?