The Forensic Toolkit (FTK) is a commercial forensic software package distributed by AccessData.
File Systems Understood
- Outlook (PST)
- Web based email like Yahoo and Hotmail
- MSN Mail
- Ext2, Ext3
- Compressed files with WinZip, GZip, Tar and others
File Search Facilities
- Lists allocated and unallocated files.
- Sorts files by type.
- Searches for keywords and regular expressions.
Can it build timelines and search by creation date?
- Can use basic keyword searching.
- Offers full-text indexing powered by dtSearch.
- Search can be focused on "Internet text".
Evidence Collection Features
Can it sign files? Does it keep an audit log?
Is it commercial or open source? Are there other licensing options?