In this section we will hash the evidence files FTK Lite created. This will allow us to maintain the integrity and authenticity of the evidence when we need to pass the image to others for analysis.

As is protocol, verify the forensic image's integrity to make sure it was not tampered with prior to the analysis stages. Check the hash in Autopsy and compare it to the MD$5$ checksum automatically generated by FTK Imager Lite earlier.

After successfully ingesting the forensic image into Autopsy, familiarize yourself with the data collected and take notes in the text file created earlier. Specifically, note the volumes present, the "Extracted Content", and if there is anything suspiscious present in the Windows$\backslash$System$32\backslash$ directory. Save the file when finished.

Begin your data extraction and recover everything from user's home folder by extracting the entire "user" folder into the E:$\backslash$image$\_$investigation$\backslash$SuspectDrive$\backslash$Export directory. Then, extract the Windows$\backslash$System$32$ folder as well.

Note: If done correctly, you will have a ####$-$user folder and a ####$-$System$32$ folder in the SuspectDrive$\backslash$Export directory.