Difference between revisions of "Forensic Toolkit"
From ForensicsWiki
Uwe Hermann (Talk | contribs) (Infobox and categories.) |
(Merged with data that was on AccessData page) |
||
| Line 12: | Line 12: | ||
=Features= | =Features= | ||
| − | + | The Forensic toolkit can parse a number of filesystems, including [[FAT]] 12/16/32, [[NTFS]], NTFS Compressed, [[Ext2]], and [[Ext3]]. It can use image files created by [[Encase]], [[SMART]], [[Snapback]], some versions of [[Safeback]] and [[dd]]. | |
| − | + | The program allows users to search with keywords or take advantage of [[drive indexing]] using the [[dtSearch]] algorithm. | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | == | + | == Data Reduction == |
| − | + | The Known File Filter, or KFF, can be used to eliminate or highlight known files using [[MD5]] hashes generated by user or from [[National Software Reference Library|NIST]] or [[Hashkeeper]]. | |
| − | + | ||
| − | + | ||
| − | == | + | == External Links == |
| − | + | [http://www.accessdata.com/catalog/partdetail.aspx?partno=11000 Forensic Toolkit information from AccessData] | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
Revision as of 01:08, 27 February 2007
| Forensic Toolkit (FTK) | |
|---|---|
| Maintainer: | AccessData |
| OS: | Windows |
| Genre: | Analysis |
| License: | Commercial |
| Website: | accessdata.com/products/ftk/ |
The Forensic Toolkit (FTK) is a commercial forensic software package distributed by AccessData.
Features
The Forensic toolkit can parse a number of filesystems, including FAT 12/16/32, NTFS, NTFS Compressed, Ext2, and Ext3. It can use image files created by Encase, SMART, Snapback, some versions of Safeback and dd.
The program allows users to search with keywords or take advantage of drive indexing using the dtSearch algorithm.
Data Reduction
The Known File Filter, or KFF, can be used to eliminate or highlight known files using MD5 hashes generated by user or from NIST or Hashkeeper.
