Difference between revisions of "FTK Imager"

From ForensicsWiki
Jump to: navigation, search
m (link)
m
Line 10: Line 10:
 
The '''Forensic Toolkit Imager''' ('''FTK Imager''') is a commercial forensic [[imaging]] software package distributed by [[AccessData]].
 
The '''Forensic Toolkit Imager''' ('''FTK Imager''') is a commercial forensic [[imaging]] software package distributed by [[AccessData]].
 
   
 
   
 +
FTK Imager supports storage of disk images in EnCase's or [[SMART]]'s file format, as well as in raw ([[dd]]) format.  With Isobuster technology built in, [[FTK Imager]] Images CD's to a ISO/CUE file combination.  This also includes multi and open session CDs.
 +
 
== Notes ==
 
== Notes ==
  
 
* '''Important''': when using FTK Imager to create a forensic image of a suspect's [[hard drive]], make sure you are using a hardware-based [[Write Blockers|write blocking device]]. This ensures that your [[operating system]] does not alter the suspect's hard drive when you attach the drive to your computer.
 
* '''Important''': when using FTK Imager to create a forensic image of a suspect's [[hard drive]], make sure you are using a hardware-based [[Write Blockers|write blocking device]]. This ensures that your [[operating system]] does not alter the suspect's hard drive when you attach the drive to your computer.

Revision as of 21:16, 20 April 2009

FTK Imager
Maintainer: AccessData
OS: Windows
Genre: Disk imaging
License: Commercial
Website: http://www.accessdata.com/downloads.html

The Forensic Toolkit Imager (FTK Imager) is a commercial forensic imaging software package distributed by AccessData.

FTK Imager supports storage of disk images in EnCase's or SMART's file format, as well as in raw (dd) format. With Isobuster technology built in, FTK Imager Images CD's to a ISO/CUE file combination. This also includes multi and open session CDs.

Notes

  • Important: when using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.