Exterro FTK Imager is a data preview and imaging tool. This application quickly obtains forensic images of computer data without making changes to the original source media.
FTK Imager Features & Capabilities
1) Data Preview & Imaging
Create forensic images of local hard drives, CDs and DVDs, thumb drives or other USB devices, entire folders, or individual files from various places within the media. Determine if further analysis with a forensic tool such as FTK Forensic Toolkit is warranted.
2) Forensic Imaging
FTK Imager creates perfect copies, or forensic images, of computer data without making changes to the original media. The forensic image is identical in every way to the original, including file slack and unallocated space or drive free space. This allows for the storing of the original media away, safe from harm while the investigation proceeds using the image.
3) Hash Reports
Generate hash reports for regular files and disk images to use as a benchmark to prove the integrity of your case evidence. After imaging an entire drive, the software generates a hash code for the image and compares it with a hash code of the drive. Matching hash codes guarantees the original source image did not change since its acquisition.
4) Image Mounting
Mount an image for a read-only view that leverages Windows Internet Explorer to see the content of the image exactly as the user saw it on the original drive. See and recover files that have been deleted from the Recycle Bin but have not yet been overwritten on the drive.
FTK Imager Main Menu
The File Menu, shown in the image below, lists the main functions performed by FTK Imager. The main functions include image mounting, disk image creation, image decryption, and exportation of files and a file hash list.
FTK Imager User Interface
Four main areas comprise the user interface. Firstly, the left half of the window is occupied mostly by the Evidence Tree. This shows the directories and files belonging to each partition, and also shows the partitions belonging to the different drives. Next, also on the left but just below that is the Hex Value Interpreter.
Then on the right half of the window is the File List. This shows the files and directories contained within any drive, partition, or directory selected in the Evidence Tree. Finally, below that is the Data Viewer Pane. The Data Viewer Pane shows the hexadecimal code and translated ASCII code for the given file selected in the File List above it.
Recommendations
Useful by digital forensic investigators and data recovery professionals alike, FTK Imager is a wonderful, free tool for imaging media.
- Firstly, its “perfect” imaging and hash reporting make it a truly unique product.
- Secondly, it mounts image files in a read-only view and displays the directory and file content of the image exactly as it is on the original drive.
- Thirdly, the FTK Imager User Interface make it both an excellent image file viewer and hexadecimal code viewer.
- Lastly, it locates and recovers deleted files from the Recycle Bin that have not yet been overwritten on the drive.
Related IT-SD Articles
