FTK

[q1s3d45g6]

Jimmy Jungle doesn't visit the schools, he only supplies Jacob :p

On a side note when I did this in forensic lab training I was able to export the exe as a 3k file, but trying it again now with a full version of the latest FTK the exe export is only 1k. I had to carve out the ZIP manually from the image with a hex editor. Any ideas?

I assume it's the same lab case as you're using

[iRsAllNight]

Is FTK free and/or Publicly available? If so how could you go by obtaining FTK?

[LukeChumley]

@iRsAllNight It's actually pretty expensive (around $1800). You can obtain it by going to accessdata's website.