Question
FTK 6.0.0 has some new processing profiles. What is the purpose of those new processing profiles?
Answer
Here is a description of each processing profile.
Field mode (or "FTK Field mode")
This profile is equivalent to "AD Field Mode" from previous versions of FTK.
Forensic Processing (or "FTK Standard")
This profile is equivalent to "AD Standard" from previous versions of FTK.
The processing profiles that are new to FTK 6.0 are below.
eDiscovery Processing
This profile has processing options that match those that are enabled in AD eDiscovery by default. It provides the suggested options for viewing and analyzing data in eDiscovery (web review). E.g. MD5 Hashing, Indexing, Cluster analysis, etc. are selected in this profile.
Summation Processing
This profile has processing options that match those that are enabled in AD Summation Pro. It provides the suggested options for viewing and analyzing data in Summation (web review). E.g. Cluster analysis, common video format generation, etc. are selected in this profile.
Basic Assessment
This option provides quicker processing because fewer processing options are enabled. E.g. Indexing and Hashing are not selected, but "compound file expansion" is included.
OVERVIEW
This support article describes the processing profiles available in FTK 6.0.0.
While the predefined processing profiles exist for your convenience, it is recommended best practice that you examine what processing options work best for your needs, and that you consider creating your own custom processing profile.
To view the processing options enabled for each of these profiles below, from the FTK case selection screen, select Manage -> Evidence Processing Profiles -> click "New Profile" and then, use the drop-down list at the bottom to select a profile.
Applies to
FTK/Lab/AD Enterprise version 6.0.0 and above