ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

FTK Imager

From ForensicsWiki
Revision as of 16:55, 16 April 2006 by Uwe Hermann (Talk | contribs) (Reverted edit of Porker, changed back to last version by Ocarroll)

Jump to: navigation, search

FTK Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with AccessData® Forensic Toolkit® (FTK™) is warranted. FTK Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence.

With FTK Imager, you can:

· Preview files and folders on local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.

· Create forensic images of local hard drives, floppy diskettes, Zip disks, CDs, and DVDs.

· Preview the contents of forensic images stored on the local machine or on a network drive.

· Export files and folders.

· Generate hash reports for regular files and disk images (including files inside disk images).


IMPORTANT: When using FTK Imager to create a forensic image of a suspect's hard drive, make sure you are using a hardware-based write blocking device. This ensures that your operating system does not alter the suspect's hard drive when you attach the drive to your computer.