Difference between revisions of "FTK Imager"

From ForensicsWiki
Jump to: navigation, search
(FTK Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis is warranted.)
 
 
(6 intermediate revisions by 5 users not shown)
Line 1: Line 1:
FTK Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with AccessData® Forensic Toolkit® (FTK™) is warranted. FTK Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence.
+
{{Infobox_Software |
 +
  name = FTK Imager |
 +
  maintainer = [[AccessData]] |
 +
  os = {{Windows}} |
 +
  genre = {{Disk imaging}} |
 +
  license = {{Commercial}} |
 +
  website = [http://www.accessdata.com/downloads.html http://www.accessdata.com/downloads.html] |
 +
}}
  
With FTK Imager, you can:
+
The '''Forensic Toolkit Imager''' ('''FTK Imager''') is a commercial forensic [[imaging]] software package distributed by [[AccessData]].
 +
 +
FTK Imager supports storage of disk images in EnCase's or [[SMART]]'s file format, as well as in raw ([[dd]]) format.  With Isobuster technology built in, [[FTK Imager]] Images CD's to a ISO/[[CUE_Sheet_format|CUE]] file combination.  This also includes multi and open session CDs.
  
·  Preview files and folders on local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.
+
== Notes ==
 
+
·  Create forensic images of local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.
+
 
+
·  Preview the contents of forensic images stored on the local machine or on a network drive.
+
 
+
·  Export files and folders.
+
 
+
·  Generate hash reports for regular files and disk images (including files inside disk images).
+
 
+
+
  
IMPORTANT: When using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.
+
* '''Important''': when using FTK Imager to create a forensic image of a suspect's [[hard drive]], make sure you are using a hardware-based [[Write Blockers|write blocking device]]. This ensures that your [[operating system]] does not alter the suspect's hard drive when you attach the drive to your computer.

Latest revision as of 14:59, 17 December 2010

FTK Imager
Maintainer: AccessData
OS: Windows
Genre: Disk imaging
License: Commercial
Website: http://www.accessdata.com/downloads.html

The Forensic Toolkit Imager (FTK Imager) is a commercial forensic imaging software package distributed by AccessData.

FTK Imager supports storage of disk images in EnCase's or SMART's file format, as well as in raw (dd) format. With Isobuster technology built in, FTK Imager Images CD's to a ISO/CUE file combination. This also includes multi and open session CDs.

Notes

  • Important: when using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.