Difference between revisions of "Forensic Toolkit"

From ForensicsWiki
Jump to: navigation, search
(Merged with data that was on AccessData page)
m (adding AFF image type support)
 
(3 intermediate revisions by 2 users not shown)
Line 5: Line 5:
 
   genre = {{Analysis}} |
 
   genre = {{Analysis}} |
 
   license = {{Commercial}} |
 
   license = {{Commercial}} |
   website = [http://www.accessdata.com/products/ftk/ accessdata.com/products/ftk/] |
+
   website = [http://www.accessdata.com/forensictoolkit.html accessdata.com] |
 
}}
 
}}
  
Line 12: Line 12:
 
=Features=
 
=Features=
  
The Forensic toolkit can parse a number of filesystems, including [[FAT]] 12/16/32, [[NTFS]], NTFS Compressed, [[Ext2]], and [[Ext3]]. It can use image files created by [[Encase]], [[SMART]], [[Snapback]], some versions of [[Safeback]] and [[dd]].
+
The Forensic toolkit can parse a number of filesystems, including [[FAT]] 12/16/32, [[NTFS]], NTFS Compressed, [[Ext2]], and [[Ext3]]. It can use image files created by [[AFF]], [[EnCase]], [[SMART]], [[Snapback]], some versions of [[Safeback]] and [[dd]].
  
 
The program allows users to search with keywords or take advantage of [[drive indexing]] using  the [[dtSearch]] algorithm.
 
The program allows users to search with keywords or take advantage of [[drive indexing]] using  the [[dtSearch]] algorithm.
Line 22: Line 22:
 
== External Links ==
 
== External Links ==
  
[http://www.accessdata.com/catalog/partdetail.aspx?partno=11000 Forensic Toolkit information from AccessData]
+
[http://www.accessdata.com/forensictoolkit.html Forensic Toolkit information from AccessData]

Latest revision as of 19:43, 4 April 2012

Forensic Toolkit (FTK)
Maintainer: AccessData
OS: Windows
Genre: Analysis
License: Commercial
Website: accessdata.com

The Forensic Toolkit (FTK) is a commercial forensic software package distributed by AccessData.

Features

The Forensic toolkit can parse a number of filesystems, including FAT 12/16/32, NTFS, NTFS Compressed, Ext2, and Ext3. It can use image files created by AFF, EnCase, SMART, Snapback, some versions of Safeback and dd.

The program allows users to search with keywords or take advantage of drive indexing using the dtSearch algorithm.

Data Reduction

The Known File Filter, or KFF, can be used to eliminate or highlight known files using MD5 hashes generated by user or from NIST or Hashkeeper.

External Links

Forensic Toolkit information from AccessData