FTK® Imager

证据采集Tool

Top

Why You Want It

FTK® Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with a forensic tool such as AccessData® Forensic Toolkit® (FTK) is warranted. FTK Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence.

SPEED

The 4.3.0 release of FTK Imager includes significant speed improvements in image creation—we've seen the time to image a device cut in half, allowing you to preserve data faster and start the analysis sooner.

ACCURACY

FTK Imager can create perfect copies, or forensic images of computer data without making changes to the original evidence. The forensic image is identical in every way to the original, including file slack and unallocated space or drive free space. This allows you to store the original media away, safe from harm while the investigation proceeds using the image.

INTEGRITY

Generate hash reports for regular files and disk images to use as a benchmark to prove the integrity of your case evidence. When a full drive is imaged, a hash generated by FTK Imager can be used to verify that the image hash and the drive hash match after the image is created, and that the image has remained unchanged since acquisition.

Capabilities To Empower You

  • Parse XFS file systems调查和收集Rhel Linux环境时。
  • Capture and view APFS imagesfrom Mac® hard drives. You only need one tool for all operating systems.
  • Create forensic imagesof local hard drives, CDs and DVDs, thumb drives or other USB devices, entire folders, or individual files from various places within the media.
  • Preview files and folderson local hard drives, network drives, CDs and DVDs, thumb drives or other USB devices.
  • Preview the contents存储在本地计算机上或网络驱动器上的法医图像。
  • Mount an image for a read-only viewthat leverages Windows®Internet Explorer®to see the content of the image exactly as the user saw it on the original drive.
  • Exportfiles and folders from forensic images.
  • 看见recover files that have been deletedfrom the Recycle Bin, but have not yet been overwritten on the drive.
  • 创建文件的哈希通过使用FTK成像器中提供的两个散列功能中的任何一种来检查数据的完整性:消息摘要5(MD5)和安全散列算法(SHA-1)。

Download FTK Imager today!

What Clients Are Saying

INTERESTED IN MORE INFORMATION?

  • Jump over to Resources for additional product brochures, case studies, white papers, as well as on-demand videos and more.RESOURCES
  • View our library of on-demand video tutorials.VIEW TUTORIALS

COMPLEMENTARY PRODUCTS

SERVICES

Our Professional Services team can work with any size organization to provide scalable support for short- or long-term initiatives, based on your needs.

Contact us today to learn more about our products and our
approach to improving how you collect, analyze and use data.
Tell Me More