📄️ Introduction
---
📄️ STEP 1: Write-Blocker Setup
---
📄️ STEP 2: SANS SIFT VM Setup
---
📄️ STEP 3: Disk Identification
---
📄️ STEP 4: Disk Cloning
---
📄️ STEP 5: Disk Mounting
---
📄️ FTK Imager
---
262COS-HA-SOP-006 - Forensic Disk Image Cloning
Procedures for forensic disk image acquisition, cloning, and mounting using the SANS SIFT VM and FTK Imager, covering write-blocker setup, disk identification, cloning, and image mounting.