Question

How can I move a case to another machine in FTK/AD Lab/AD Enterprise?

 

Answer

On the system housing the case:

  1. Open FTK
  2. At the case list, right-click the case you wish to move and select Backup > Backup
  3. Select a folder name (that doesn't already exist) to backup the case to, then click "OK"
    Note: In versions 3.4-4.1, you must also check "Use database independent format"
  4. Wait for the backup to complete
  5. Copy the evidence for the case and the entire backup folder from step 3 to the destination system

On the destination system:

  1. Open FTK
  2. Under the "Case" menu select Restore > Restore
  3. Select the backup folder to restore from, then click "OK"
  4. Choose which Old Users to associate to the New Users, then click "OK"
  5. Choose whether you'd like to restore the case to the default case folder or a different folder
  6. Wait for the restore to complete
  7. Open the case
  8. Go to Evidence > Add/Remove
  9. For each piece of evidence in the case, highlight the evidence in the list on the left and update its "Path" on the right to point to the new evidence location, then click "OK"