 Welcome back, everyone. Today, I'm going to show you how to verify or hash a physical disk using FTK Imager. And I'm using FTK Imager 4.2.0.13, which is the newest version at this time from Access Data's website. There's also the FTK Imager Lite version 3.1.1. If you're the version, basically 4.2.0, you have to install. So you wouldn't be using it in a suspect system, but maybe the Lite version you would use in some sort of live environment. Again, be very careful about changing suspect data. But if you know what you're doing, you might use the Lite version. For now, we're going to imagine that we are working on our forensic workstation. So we have installed FTK Imager 4.2.0. And now we want to verify or hash a physical disk. Okay, so in this virtual machine, I already have a physical disk installed. And it's just a USB stick. Imagine that I've connected it with a hardware write blocker. If you do have a software write blocker, you could use that as well. I prefer hardware write blockers. In this case, it's built into my system. Okay, so now we have this disk attached and Windows has recognized it. We open up FTK Imager. And then we go to file. And we want to add evidence item, add evidence item. You can also add an evidence item just by clicking this single plus sign. There's kind of one plus sign with a magnifying glass and two plus signs with a magnifying glass. Click the one with one plus sign. And we want to add a physical drive, a physical drive. So click Next. And the physical drive we want to add is this physical drive one. And I can tell it's the drive I want because the size is correct. For adding a suspect disk, we should always or hopefully we know what the size of the disk is. For a lot of disks like a, in this case, even a USB stick would say the size of the disk on the connector. If we have a internal disk, we should be able to read the label and find the size of the disk, especially maybe even the manufacturer or something like that. So in this case, we know that USB 2.0, USB device for gig USB, that is the disk that I want to hash or verify. So click that, that's physical drive one. On your computer, it might show up as slashes instead of W's. So click physical drive one and then click finish. So now we've added it. And we could look at the hex view if we wanted to, but for now we are just looking, or we want to know, we want to verify the disk image. So if I click the plus button, we can see that there is one partition and there is some art, unpartition space. Okay, but we don't really have to worry about that. I just wanted to make sure that it does detect something is there because in this case, it should. So if we right click right click on physical drive one, we have the verify verify drive slash image option. So go ahead and click that and it will just start hashing. That's that's pretty much all there is to it. Whenever it's finished with that, it will pop up with a report about the hash values that it will get. And I believe it's an MD five and Sha one hash values unless we configure it otherwise. So I will let this run and whenever it's finished, I'll come back. Okay, so now hashing is complete. And we can see that the name of the device was physical drive one, we need to document what what drive that actually is. For example, in this case, the USB drive, so I would have to actually attach that to some identifier on the USB stick. Because the physical drive one, if I added other drives, then the drive number is assigned depending on how many drives you have. So that could change. So we have to say physical drive one. But actually, this is that my in this case blue USB stick. We have a sector counts. We have the computed hash for MD five shot one hash computed and bad sector list and nothing was found. Whenever we image a disk, a report will be created that will save this information. Whenever we just to hash or verify the results like this, the report I don't believe is saved or at least I haven't found what it's saved at. So we would actually have to record this ourselves. I usually take a screenshot whenever we're doing this. So that's how to hash or verify a physical drive. Thank you very much.