Your machine is now ready to house the forensic image. Here, you will create an image and then verify its initial hash for integrity purposes.

Extract the contents Imager$\_$Lite$\_3\mathrm{.}1\mathrm{.}1.$zip into E:$\backslash .$ This folder contains FTK Imager, which you will use to create the image.

Create a new folder in the E:$\backslash$ drive titled image$\_$investigation. This folder will receive everything related to your image investigation.

Next, open FTK Imager from the folder in the E:$\backslash$ drive, and create an image of the C:$\backslash$ drive. Be sure to select the Encase image file format, name the image c$\_$drive, and save the image to E:$\backslash$image$\_$investigation$\backslash .$

Note: When configuring preferences for the image, follow the following guidelines: do not encrypt the AD$,$ use the fastest compression possible, and avoid segmenting the image.

Creating an image with FTK should automatically generate a text file containing a hash value for the hard disk, but not for the $.$E$01$ file. Use md$5$deep$64$ from the command prompt to find the hash of the $.$E$01$ file.