Disk images can be accessed in a number of ways. This guide will include instructions for accessing disk images via FTK Imager and BitCurator. The reason for including both access methods is that both methods have strengths and weaknesses. Specifically, FTK Imager is easy to use, runs natively in Windows, and requires no special knowledge. BitCurator is not quite as easy to use and must be run in a VM in order to be accessed through Windows. However, with BitCurator’s added complexity comes the ability to use the various digital forensics tools included in BitCurator, and the ability to search across the file system using the “find” command. It may be advantageous to offer researchers the easy-to-use yet limited FTK Imager level of access, but reserve the more powerful access tools in BitCurtor for those with administrative responsibilities.
https://docs.google.com/document/d/135shOOu17co3ADmhc5hi2CyU3SWHqzIKJXOzMhqN63o/edit
